From ae7c3b0197636e0a4eb7e576ab2f4b647546f0ed Mon Sep 17 00:00:00 2001 From: awstools Date: Thu, 6 Jun 2024 18:13:53 +0000 Subject: [PATCH] feat(client-firehose): Adds integration with Secrets Manager for Redshift, Splunk, HttpEndpoint, and Snowflake destinations --- clients/client-firehose/README.md | 7 +- clients/client-firehose/src/Firehose.ts | 7 +- clients/client-firehose/src/FirehoseClient.ts | 7 +- .../commands/CreateDeliveryStreamCommand.ts | 30 +++- .../commands/DescribeDeliveryStreamCommand.ts | 22 ++- .../StartDeliveryStreamEncryptionCommand.ts | 4 +- .../src/commands/UpdateDestinationCommand.ts | 20 +++ clients/client-firehose/src/index.ts | 7 +- .../client-firehose/src/models/models_0.ts | 144 ++++++++++++++++-- .../src/protocols/Aws_json1_1.ts | 5 + codegen/sdk-codegen/aws-models/firehose.json | 137 ++++++++++++++--- 11 files changed, 341 insertions(+), 49 deletions(-) diff --git a/clients/client-firehose/README.md b/clients/client-firehose/README.md index b3db630d7b0e3..8b45ed909a4ad 100644 --- a/clients/client-firehose/README.md +++ b/clients/client-firehose/README.md @@ -11,10 +11,9 @@ AWS SDK for JavaScript Firehose Client for Node.js, Browser and React Native.

Amazon Data Firehose was previously known as Amazon Kinesis Data Firehose.

-

Amazon Data Firehose is a fully managed service that delivers real-time -streaming data to destinations such as Amazon Simple Storage Service (Amazon S3), Amazon -OpenSearch Service, Amazon Redshift, Splunk, and various other supportd -destinations.

+

Amazon Data Firehose is a fully managed service that delivers real-time streaming +data to destinations such as Amazon Simple Storage Service (Amazon S3), Amazon OpenSearch +Service, Amazon Redshift, Splunk, and various other supported destinations.

## Installing diff --git a/clients/client-firehose/src/Firehose.ts b/clients/client-firehose/src/Firehose.ts index 02e8c65d107f8..91b8d208dda28 100644 --- a/clients/client-firehose/src/Firehose.ts +++ b/clients/client-firehose/src/Firehose.ts @@ -278,10 +278,9 @@ export interface Firehose { * *

Amazon Data Firehose was previously known as Amazon Kinesis Data Firehose.

* - *

Amazon Data Firehose is a fully managed service that delivers real-time - * streaming data to destinations such as Amazon Simple Storage Service (Amazon S3), Amazon - * OpenSearch Service, Amazon Redshift, Splunk, and various other supportd - * destinations.

+ *

Amazon Data Firehose is a fully managed service that delivers real-time streaming + * data to destinations such as Amazon Simple Storage Service (Amazon S3), Amazon OpenSearch + * Service, Amazon Redshift, Splunk, and various other supported destinations.

* @public */ export class Firehose extends FirehoseClient implements Firehose {} diff --git a/clients/client-firehose/src/FirehoseClient.ts b/clients/client-firehose/src/FirehoseClient.ts index bd4b058cd851b..bcb5b4a4f2a11 100644 --- a/clients/client-firehose/src/FirehoseClient.ts +++ b/clients/client-firehose/src/FirehoseClient.ts @@ -310,10 +310,9 @@ export interface FirehoseClientResolvedConfig extends FirehoseClientResolvedConf * *

Amazon Data Firehose was previously known as Amazon Kinesis Data Firehose.

* - *

Amazon Data Firehose is a fully managed service that delivers real-time - * streaming data to destinations such as Amazon Simple Storage Service (Amazon S3), Amazon - * OpenSearch Service, Amazon Redshift, Splunk, and various other supportd - * destinations.

+ *

Amazon Data Firehose is a fully managed service that delivers real-time streaming + * data to destinations such as Amazon Simple Storage Service (Amazon S3), Amazon OpenSearch + * Service, Amazon Redshift, Splunk, and various other supported destinations.

* @public */ export class FirehoseClient extends __Client< diff --git a/clients/client-firehose/src/commands/CreateDeliveryStreamCommand.ts b/clients/client-firehose/src/commands/CreateDeliveryStreamCommand.ts index a7cc28ef30869..1099af2ae571f 100644 --- a/clients/client-firehose/src/commands/CreateDeliveryStreamCommand.ts +++ b/clients/client-firehose/src/commands/CreateDeliveryStreamCommand.ts @@ -266,8 +266,8 @@ export interface CreateDeliveryStreamCommandOutput extends CreateDeliveryStreamO * DataTableColumns: "STRING_VALUE", * CopyOptions: "STRING_VALUE", * }, - * Username: "STRING_VALUE", // required - * Password: "STRING_VALUE", // required + * Username: "STRING_VALUE", + * Password: "STRING_VALUE", * RetryOptions: { // RedshiftRetryOptions * DurationInSeconds: Number("int"), * }, @@ -331,6 +331,11 @@ export interface CreateDeliveryStreamCommandOutput extends CreateDeliveryStreamO * }, * }, * CloudWatchLoggingOptions: "", + * SecretsManagerConfiguration: { // SecretsManagerConfiguration + * SecretARN: "STRING_VALUE", + * RoleARN: "STRING_VALUE", + * Enabled: true || false, // required + * }, * }, * ElasticsearchDestinationConfiguration: { // ElasticsearchDestinationConfiguration * RoleARN: "STRING_VALUE", // required @@ -432,7 +437,7 @@ export interface CreateDeliveryStreamCommandOutput extends CreateDeliveryStreamO * SplunkDestinationConfiguration: { // SplunkDestinationConfiguration * HECEndpoint: "STRING_VALUE", // required * HECEndpointType: "Raw" || "Event", // required - * HECToken: "STRING_VALUE", // required + * HECToken: "STRING_VALUE", * HECAcknowledgmentTimeoutInSeconds: Number("int"), * RetryOptions: { // SplunkRetryOptions * DurationInSeconds: Number("int"), @@ -458,6 +463,11 @@ export interface CreateDeliveryStreamCommandOutput extends CreateDeliveryStreamO * IntervalInSeconds: Number("int"), * SizeInMBs: Number("int"), * }, + * SecretsManagerConfiguration: { + * SecretARN: "STRING_VALUE", + * RoleARN: "STRING_VALUE", + * Enabled: true || false, // required + * }, * }, * HttpEndpointDestinationConfiguration: { // HttpEndpointDestinationConfiguration * EndpointConfiguration: { // HttpEndpointConfiguration @@ -486,6 +496,11 @@ export interface CreateDeliveryStreamCommandOutput extends CreateDeliveryStreamO * }, * S3BackupMode: "FailedDataOnly" || "AllData", * S3Configuration: "", // required + * SecretsManagerConfiguration: { + * SecretARN: "STRING_VALUE", + * RoleARN: "STRING_VALUE", + * Enabled: true || false, // required + * }, * }, * Tags: [ // TagDeliveryStreamInputTagList * { // Tag @@ -528,9 +543,9 @@ export interface CreateDeliveryStreamCommandOutput extends CreateDeliveryStreamO * }, * SnowflakeDestinationConfiguration: { // SnowflakeDestinationConfiguration * AccountUrl: "STRING_VALUE", // required - * PrivateKey: "STRING_VALUE", // required + * PrivateKey: "STRING_VALUE", * KeyPassphrase: "STRING_VALUE", - * User: "STRING_VALUE", // required + * User: "STRING_VALUE", * Database: "STRING_VALUE", // required * Schema: "STRING_VALUE", // required * Table: "STRING_VALUE", // required @@ -552,6 +567,11 @@ export interface CreateDeliveryStreamCommandOutput extends CreateDeliveryStreamO * }, * S3BackupMode: "FailedDataOnly" || "AllData", * S3Configuration: "", // required + * SecretsManagerConfiguration: { + * SecretARN: "STRING_VALUE", + * RoleARN: "STRING_VALUE", + * Enabled: true || false, // required + * }, * }, * }; * const command = new CreateDeliveryStreamCommand(input); diff --git a/clients/client-firehose/src/commands/DescribeDeliveryStreamCommand.ts b/clients/client-firehose/src/commands/DescribeDeliveryStreamCommand.ts index 1303ea1e907e9..88d015713a2b9 100644 --- a/clients/client-firehose/src/commands/DescribeDeliveryStreamCommand.ts +++ b/clients/client-firehose/src/commands/DescribeDeliveryStreamCommand.ts @@ -243,7 +243,7 @@ export interface DescribeDeliveryStreamCommandOutput extends DescribeDeliveryStr * // DataTableColumns: "STRING_VALUE", * // CopyOptions: "STRING_VALUE", * // }, - * // Username: "STRING_VALUE", // required + * // Username: "STRING_VALUE", * // RetryOptions: { // RedshiftRetryOptions * // DurationInSeconds: Number("int"), * // }, @@ -307,6 +307,11 @@ export interface DescribeDeliveryStreamCommandOutput extends DescribeDeliveryStr * // }, * // }, * // CloudWatchLoggingOptions: "", + * // SecretsManagerConfiguration: { // SecretsManagerConfiguration + * // SecretARN: "STRING_VALUE", + * // RoleARN: "STRING_VALUE", + * // Enabled: true || false, // required + * // }, * // }, * // ElasticsearchDestinationDescription: { // ElasticsearchDestinationDescription * // RoleARN: "STRING_VALUE", @@ -436,6 +441,11 @@ export interface DescribeDeliveryStreamCommandOutput extends DescribeDeliveryStr * // IntervalInSeconds: Number("int"), * // SizeInMBs: Number("int"), * // }, + * // SecretsManagerConfiguration: { + * // SecretARN: "STRING_VALUE", + * // RoleARN: "STRING_VALUE", + * // Enabled: true || false, // required + * // }, * // }, * // HttpEndpointDestinationDescription: { // HttpEndpointDestinationDescription * // EndpointConfiguration: { // HttpEndpointDescription @@ -463,6 +473,11 @@ export interface DescribeDeliveryStreamCommandOutput extends DescribeDeliveryStr * // }, * // S3BackupMode: "FailedDataOnly" || "AllData", * // S3DestinationDescription: "", + * // SecretsManagerConfiguration: { + * // SecretARN: "STRING_VALUE", + * // RoleARN: "STRING_VALUE", + * // Enabled: true || false, // required + * // }, * // }, * // SnowflakeDestinationDescription: { // SnowflakeDestinationDescription * // AccountUrl: "STRING_VALUE", @@ -488,6 +503,11 @@ export interface DescribeDeliveryStreamCommandOutput extends DescribeDeliveryStr * // }, * // S3BackupMode: "FailedDataOnly" || "AllData", * // S3DestinationDescription: "", + * // SecretsManagerConfiguration: { + * // SecretARN: "STRING_VALUE", + * // RoleARN: "STRING_VALUE", + * // Enabled: true || false, // required + * // }, * // }, * // AmazonOpenSearchServerlessDestinationDescription: { // AmazonOpenSearchServerlessDestinationDescription * // RoleARN: "STRING_VALUE", diff --git a/clients/client-firehose/src/commands/StartDeliveryStreamEncryptionCommand.ts b/clients/client-firehose/src/commands/StartDeliveryStreamEncryptionCommand.ts index 62544b451dd21..d63dfa01b904e 100644 --- a/clients/client-firehose/src/commands/StartDeliveryStreamEncryptionCommand.ts +++ b/clients/client-firehose/src/commands/StartDeliveryStreamEncryptionCommand.ts @@ -52,7 +52,9 @@ export interface StartDeliveryStreamEncryptionCommandOutput * CMK is of type CUSTOMER_MANAGED_CMK, Firehose creates a grant * that enables it to use the new CMK to encrypt and decrypt data and to manage the * grant.

- *

For the KMS grant creation to be successful, Firehose APIs StartDeliveryStreamEncryption and CreateDeliveryStream should not be called with session credentials that are more than 6 hours old.

+ *

For the KMS grant creation to be successful, the Firehose API operations + * StartDeliveryStreamEncryption and CreateDeliveryStream should + * not be called with session credentials that are more than 6 hours old.

*

If a delivery stream already has encryption enabled and then you invoke this operation * to change the ARN of the CMK or both its type and ARN and you get * ENABLING_FAILED, this only means that the attempt to change the CMK failed. diff --git a/clients/client-firehose/src/commands/UpdateDestinationCommand.ts b/clients/client-firehose/src/commands/UpdateDestinationCommand.ts index 2fa64b88f8ea4..60468522a6b17 100644 --- a/clients/client-firehose/src/commands/UpdateDestinationCommand.ts +++ b/clients/client-firehose/src/commands/UpdateDestinationCommand.ts @@ -280,6 +280,11 @@ export interface UpdateDestinationCommandOutput extends UpdateDestinationOutput, * }, * }, * CloudWatchLoggingOptions: "", + * SecretsManagerConfiguration: { // SecretsManagerConfiguration + * SecretARN: "STRING_VALUE", + * RoleARN: "STRING_VALUE", + * Enabled: true || false, // required + * }, * }, * ElasticsearchDestinationUpdate: { // ElasticsearchDestinationUpdate * RoleARN: "STRING_VALUE", @@ -387,6 +392,11 @@ export interface UpdateDestinationCommandOutput extends UpdateDestinationOutput, * IntervalInSeconds: Number("int"), * SizeInMBs: Number("int"), * }, + * SecretsManagerConfiguration: { + * SecretARN: "STRING_VALUE", + * RoleARN: "STRING_VALUE", + * Enabled: true || false, // required + * }, * }, * HttpEndpointDestinationUpdate: { // HttpEndpointDestinationUpdate * EndpointConfiguration: { // HttpEndpointConfiguration @@ -415,6 +425,11 @@ export interface UpdateDestinationCommandOutput extends UpdateDestinationOutput, * }, * S3BackupMode: "FailedDataOnly" || "AllData", * S3Update: "", + * SecretsManagerConfiguration: { + * SecretARN: "STRING_VALUE", + * RoleARN: "STRING_VALUE", + * Enabled: true || false, // required + * }, * }, * AmazonOpenSearchServerlessDestinationUpdate: { // AmazonOpenSearchServerlessDestinationUpdate * RoleARN: "STRING_VALUE", @@ -454,6 +469,11 @@ export interface UpdateDestinationCommandOutput extends UpdateDestinationOutput, * }, * S3BackupMode: "FailedDataOnly" || "AllData", * S3Update: "", + * SecretsManagerConfiguration: { + * SecretARN: "STRING_VALUE", + * RoleARN: "STRING_VALUE", + * Enabled: true || false, // required + * }, * }, * }; * const command = new UpdateDestinationCommand(input); diff --git a/clients/client-firehose/src/index.ts b/clients/client-firehose/src/index.ts index 49e5c6788ca19..b23fbd1c3e88b 100644 --- a/clients/client-firehose/src/index.ts +++ b/clients/client-firehose/src/index.ts @@ -5,10 +5,9 @@ * *

Amazon Data Firehose was previously known as Amazon Kinesis Data Firehose.

* - *

Amazon Data Firehose is a fully managed service that delivers real-time - * streaming data to destinations such as Amazon Simple Storage Service (Amazon S3), Amazon - * OpenSearch Service, Amazon Redshift, Splunk, and various other supportd - * destinations.

+ *

Amazon Data Firehose is a fully managed service that delivers real-time streaming + * data to destinations such as Amazon Simple Storage Service (Amazon S3), Amazon OpenSearch + * Service, Amazon Redshift, Splunk, and various other supported destinations.

* * @packageDocumentation */ diff --git a/clients/client-firehose/src/models/models_0.ts b/clients/client-firehose/src/models/models_0.ts index 28308bfdd16bc..e0dad9183a309 100644 --- a/clients/client-firehose/src/models/models_0.ts +++ b/clients/client-firehose/src/models/models_0.ts @@ -1885,7 +1885,7 @@ export type ParquetWriterVersion = (typeof ParquetWriterVersion)[keyof typeof Pa /** *

A serializer to use for converting data to the Parquet format before storing it in - * Amazon S3. For more information, see Apache Parquet.

+ * Amazon S3. For more information, see Apache Parquet.

* @public */ export interface ParquetSerDe { @@ -2371,6 +2371,36 @@ export const HttpEndpointS3BackupMode = { */ export type HttpEndpointS3BackupMode = (typeof HttpEndpointS3BackupMode)[keyof typeof HttpEndpointS3BackupMode]; +/** + *

The structure that defines how Firehose accesses the secret.

+ * @public + */ +export interface SecretsManagerConfiguration { + /** + *

The ARN of the secret that stores your credentials. It must be in the same region as the + * Firehose stream and the role. The secret ARN can reside in a different account than the delivery stream and role as Firehose supports cross-account secret access. This parameter is required when Enabled is set to True.

+ * @public + */ + SecretARN?: string; + + /** + *

+ * Specifies the role that Firehose assumes when calling the Secrets Manager API operation. When you provide the role, it overrides any destination specific role defined in the destination configuration. If you do not provide the then we use the destination specific role. This parameter is required for Splunk. + *

+ * @public + */ + RoleARN?: string; + + /** + *

Specifies whether you want to use the the secrets manager feature. When set as + * True the secrets manager configuration overwrites the existing secrets in + * the destination configuration. When it's set to False Firehose falls back to + * the credentials in the destination configuration.

+ * @public + */ + Enabled: boolean | undefined; +} + /** *

Describes the configuration of the HTTP endpoint destination.

* @public @@ -2399,7 +2429,7 @@ export interface HttpEndpointDestinationConfiguration { CloudWatchLoggingOptions?: CloudWatchLoggingOptions; /** - *

The configuration of the requeste sent to the HTTP endpoint specified as the + *

The configuration of the request sent to the HTTP endpoint that is specified as the * destination.

* @public */ @@ -2440,6 +2470,14 @@ export interface HttpEndpointDestinationConfiguration { * @public */ S3Configuration: S3DestinationConfiguration | undefined; + + /** + *

+ * The configuration that defines how you access secrets for HTTP Endpoint destination. + *

+ * @public + */ + SecretsManagerConfiguration?: SecretsManagerConfiguration; } /** @@ -2549,13 +2587,13 @@ export interface RedshiftDestinationConfiguration { *

The name of the user.

* @public */ - Username: string | undefined; + Username?: string; /** *

The user password.

* @public */ - Password: string | undefined; + Password?: string; /** *

The retry behavior in case Firehose is unable to deliver documents to @@ -2600,6 +2638,14 @@ export interface RedshiftDestinationConfiguration { * @public */ CloudWatchLoggingOptions?: CloudWatchLoggingOptions; + + /** + *

+ * The configuration that defines how you access secrets for Amazon Redshift. + *

+ * @public + */ + SecretsManagerConfiguration?: SecretsManagerConfiguration; } /** @@ -2699,7 +2745,7 @@ export interface SnowflakeDestinationConfiguration { *

The private key used to encrypt your Snowflake client. For information, see Using Key Pair Authentication & Key Rotation.

* @public */ - PrivateKey: string | undefined; + PrivateKey?: string; /** *

Passphrase to decrypt the private key when the key is encrypted. For information, see Using Key Pair Authentication & Key Rotation.

@@ -2711,7 +2757,7 @@ export interface SnowflakeDestinationConfiguration { *

User login name for the Snowflake account.

* @public */ - User: string | undefined; + User?: string; /** *

All data in Snowflake is maintained in databases.

@@ -2798,6 +2844,14 @@ export interface SnowflakeDestinationConfiguration { * @public */ S3Configuration: S3DestinationConfiguration | undefined; + + /** + *

+ * The configuration that defines how you access secrets for Snowflake. + *

+ * @public + */ + SecretsManagerConfiguration?: SecretsManagerConfiguration; } /** @@ -2887,7 +2941,7 @@ export interface SplunkDestinationConfiguration { * endpoint.

* @public */ - HECToken: string | undefined; + HECToken?: string; /** *

The amount of time that Firehose waits to receive an acknowledgment from @@ -2941,6 +2995,14 @@ export interface SplunkDestinationConfiguration { * @public */ BufferingHints?: SplunkBufferingHints; + + /** + *

+ * The configuration that defines how you access secrets for Splunk. + *

+ * @public + */ + SecretsManagerConfiguration?: SecretsManagerConfiguration; } /** @@ -3670,6 +3732,14 @@ export interface HttpEndpointDestinationDescription { * @public */ S3DestinationDescription?: S3DestinationDescription; + + /** + *

+ * The configuration that defines how you access secrets for HTTP Endpoint destination. + *

+ * @public + */ + SecretsManagerConfiguration?: SecretsManagerConfiguration; } /** @@ -3701,7 +3771,7 @@ export interface RedshiftDestinationDescription { *

The name of the user.

* @public */ - Username: string | undefined; + Username?: string; /** *

The retry behavior in case Firehose is unable to deliver documents to @@ -3739,6 +3809,14 @@ export interface RedshiftDestinationDescription { * @public */ CloudWatchLoggingOptions?: CloudWatchLoggingOptions; + + /** + *

+ * The configuration that defines how you access secrets for Amazon Redshift. + *

+ * @public + */ + SecretsManagerConfiguration?: SecretsManagerConfiguration; } /** @@ -3844,6 +3922,14 @@ export interface SnowflakeDestinationDescription { * @public */ S3DestinationDescription?: S3DestinationDescription; + + /** + *

+ * The configuration that defines how you access secrets for Snowflake. + *

+ * @public + */ + SecretsManagerConfiguration?: SecretsManagerConfiguration; } /** @@ -3920,6 +4006,14 @@ export interface SplunkDestinationDescription { * @public */ BufferingHints?: SplunkBufferingHints; + + /** + *

+ * The configuration that defines how you access secrets for Splunk. + *

+ * @public + */ + SecretsManagerConfiguration?: SecretsManagerConfiguration; } /** @@ -4840,6 +4934,14 @@ export interface HttpEndpointDestinationUpdate { * @public */ S3Update?: S3DestinationUpdate; + + /** + *

+ * The configuration that defines how you access secrets for HTTP Endpoint destination. + *

+ * @public + */ + SecretsManagerConfiguration?: SecretsManagerConfiguration; } /** @@ -4920,6 +5022,14 @@ export interface RedshiftDestinationUpdate { * @public */ CloudWatchLoggingOptions?: CloudWatchLoggingOptions; + + /** + *

+ * The configuration that defines how you access secrets for Amazon Redshift. + *

+ * @public + */ + SecretsManagerConfiguration?: SecretsManagerConfiguration; } /** @@ -5037,6 +5147,14 @@ export interface SnowflakeDestinationUpdate { * @public */ S3Update?: S3DestinationUpdate; + + /** + *

+ * Describes the Secrets Manager configuration in Snowflake. + *

+ * @public + */ + SecretsManagerConfiguration?: SecretsManagerConfiguration; } /** @@ -5116,6 +5234,14 @@ export interface SplunkDestinationUpdate { * @public */ BufferingHints?: SplunkBufferingHints; + + /** + *

+ * The configuration that defines how you access secrets for Splunk. + *

+ * @public + */ + SecretsManagerConfiguration?: SecretsManagerConfiguration; } /** @@ -5196,7 +5322,7 @@ export interface UpdateDestinationInput { AmazonOpenSearchServerlessDestinationUpdate?: AmazonOpenSearchServerlessDestinationUpdate; /** - *

Update to the Snowflake destination condiguration settings

+ *

Update to the Snowflake destination configuration settings.

* @public */ SnowflakeDestinationUpdate?: SnowflakeDestinationUpdate; diff --git a/clients/client-firehose/src/protocols/Aws_json1_1.ts b/clients/client-firehose/src/protocols/Aws_json1_1.ts index 0565506a8b45d..bb7230e1fb7dd 100644 --- a/clients/client-firehose/src/protocols/Aws_json1_1.ts +++ b/clients/client-firehose/src/protocols/Aws_json1_1.ts @@ -132,6 +132,7 @@ import { S3DestinationConfiguration, S3DestinationUpdate, SchemaConfiguration, + SecretsManagerConfiguration, Serializer, ServiceUnavailableException, SnowflakeDestinationConfiguration, @@ -985,6 +986,8 @@ const se__Record = (input: _Record, context: __SerdeContext): any => { // se_SchemaConfiguration omitted. +// se_SecretsManagerConfiguration omitted. + // se_SecurityGroupIdList omitted. /** @@ -1325,6 +1328,8 @@ const de_OutputFormatConfiguration = (output: any, context: __SerdeContext): Out // de_SchemaConfiguration omitted. +// de_SecretsManagerConfiguration omitted. + // de_SecurityGroupIdList omitted. /** diff --git a/codegen/sdk-codegen/aws-models/firehose.json b/codegen/sdk-codegen/aws-models/firehose.json index f54abf5582053..6e64fdfb5ac69 100644 --- a/codegen/sdk-codegen/aws-models/firehose.json +++ b/codegen/sdk-codegen/aws-models/firehose.json @@ -2614,7 +2614,7 @@ "name": "firehose" }, "aws.protocols#awsJson1_1": {}, - "smithy.api#documentation": "Amazon Data Firehose\n \n

Amazon Data Firehose was previously known as Amazon Kinesis Data Firehose.

\n \n

Amazon Data Firehose is a fully managed service that delivers real-time\n streaming data to destinations such as Amazon Simple Storage Service (Amazon S3), Amazon\n OpenSearch Service, Amazon Redshift, Splunk, and various other supportd\n destinations.

", + "smithy.api#documentation": "Amazon Data Firehose\n \n

Amazon Data Firehose was previously known as Amazon Kinesis Data Firehose.

\n \n

Amazon Data Firehose is a fully managed service that delivers real-time streaming\n data to destinations such as Amazon Simple Storage Service (Amazon S3), Amazon OpenSearch\n Service, Amazon Redshift, Splunk, and various other supported destinations.

", "smithy.api#title": "Amazon Kinesis Firehose", "smithy.api#xmlNamespace": { "uri": "http://firehose.amazonaws.com/doc/2015-08-04" @@ -3834,7 +3834,7 @@ "RequestConfiguration": { "target": "com.amazonaws.firehose#HttpEndpointRequestConfiguration", "traits": { - "smithy.api#documentation": "

The configuration of the requeste sent to the HTTP endpoint specified as the\n destination.

" + "smithy.api#documentation": "

The configuration of the request sent to the HTTP endpoint that is specified as the\n destination.

" } }, "ProcessingConfiguration": { @@ -3863,6 +3863,12 @@ "traits": { "smithy.api#required": {} } + }, + "SecretsManagerConfiguration": { + "target": "com.amazonaws.firehose#SecretsManagerConfiguration", + "traits": { + "smithy.api#documentation": "

\n The configuration that defines how you access secrets for HTTP Endpoint destination.\n

" + } } }, "traits": { @@ -3916,6 +3922,12 @@ }, "S3DestinationDescription": { "target": "com.amazonaws.firehose#S3DestinationDescription" + }, + "SecretsManagerConfiguration": { + "target": "com.amazonaws.firehose#SecretsManagerConfiguration", + "traits": { + "smithy.api#documentation": "

\n The configuration that defines how you access secrets for HTTP Endpoint destination.\n

" + } } }, "traits": { @@ -3969,6 +3981,12 @@ }, "S3Update": { "target": "com.amazonaws.firehose#S3DestinationUpdate" + }, + "SecretsManagerConfiguration": { + "target": "com.amazonaws.firehose#SecretsManagerConfiguration", + "traits": { + "smithy.api#documentation": "

\n The configuration that defines how you access secrets for HTTP Endpoint destination.\n

" + } } }, "traits": { @@ -4769,7 +4787,7 @@ } }, "traits": { - "smithy.api#documentation": "

A serializer to use for converting data to the Parquet format before storing it in\n Amazon S3. For more information, see Apache Parquet.

" + "smithy.api#documentation": "

A serializer to use for converting data to the Parquet format before storing it in\n Amazon S3. For more information, see Apache Parquet.

" } }, "com.amazonaws.firehose#ParquetWriterVersion": { @@ -5267,15 +5285,13 @@ "Username": { "target": "com.amazonaws.firehose#Username", "traits": { - "smithy.api#documentation": "

The name of the user.

", - "smithy.api#required": {} + "smithy.api#documentation": "

The name of the user.

" } }, "Password": { "target": "com.amazonaws.firehose#Password", "traits": { - "smithy.api#documentation": "

The user password.

", - "smithy.api#required": {} + "smithy.api#documentation": "

The user password.

" } }, "RetryOptions": { @@ -5314,6 +5330,12 @@ "traits": { "smithy.api#documentation": "

The CloudWatch logging options for your delivery stream.

" } + }, + "SecretsManagerConfiguration": { + "target": "com.amazonaws.firehose#SecretsManagerConfiguration", + "traits": { + "smithy.api#documentation": "

\n The configuration that defines how you access secrets for Amazon Redshift.\n

" + } } }, "traits": { @@ -5347,8 +5369,7 @@ "Username": { "target": "com.amazonaws.firehose#Username", "traits": { - "smithy.api#documentation": "

The name of the user.

", - "smithy.api#required": {} + "smithy.api#documentation": "

The name of the user.

" } }, "RetryOptions": { @@ -5387,6 +5408,12 @@ "traits": { "smithy.api#documentation": "

The Amazon CloudWatch logging options for your delivery stream.

" } + }, + "SecretsManagerConfiguration": { + "target": "com.amazonaws.firehose#SecretsManagerConfiguration", + "traits": { + "smithy.api#documentation": "

\n The configuration that defines how you access secrets for Amazon Redshift.\n

" + } } }, "traits": { @@ -5461,6 +5488,12 @@ "traits": { "smithy.api#documentation": "

The Amazon CloudWatch logging options for your delivery stream.

" } + }, + "SecretsManagerConfiguration": { + "target": "com.amazonaws.firehose#SecretsManagerConfiguration", + "traits": { + "smithy.api#documentation": "

\n The configuration that defines how you access secrets for Amazon Redshift.\n

" + } } }, "traits": { @@ -5806,6 +5839,43 @@ "smithy.api#documentation": "

Specifies the schema to which you want Firehose to configure your data\n before it writes it to Amazon S3. This parameter is required if Enabled is set\n to true.

" } }, + "com.amazonaws.firehose#SecretARN": { + "type": "string", + "traits": { + "smithy.api#length": { + "min": 1, + "max": 2048 + }, + "smithy.api#pattern": "^arn:" + } + }, + "com.amazonaws.firehose#SecretsManagerConfiguration": { + "type": "structure", + "members": { + "SecretARN": { + "target": "com.amazonaws.firehose#SecretARN", + "traits": { + "smithy.api#documentation": "

The ARN of the secret that stores your credentials. It must be in the same region as the\n Firehose stream and the role. The secret ARN can reside in a different account than the delivery stream and role as Firehose supports cross-account secret access. This parameter is required when Enabled is set to True.

" + } + }, + "RoleARN": { + "target": "com.amazonaws.firehose#RoleARN", + "traits": { + "smithy.api#documentation": "

\n Specifies the role that Firehose assumes when calling the Secrets Manager API operation. When you provide the role, it overrides any destination specific role defined in the destination configuration. If you do not provide the then we use the destination specific role. This parameter is required for Splunk.\n

" + } + }, + "Enabled": { + "target": "com.amazonaws.firehose#BooleanObject", + "traits": { + "smithy.api#documentation": "

Specifies whether you want to use the the secrets manager feature. When set as\n True the secrets manager configuration overwrites the existing secrets in\n the destination configuration. When it's set to False Firehose falls back to\n the credentials in the destination configuration.

", + "smithy.api#required": {} + } + } + }, + "traits": { + "smithy.api#documentation": "

The structure that defines how Firehose accesses the secret.

" + } + }, "com.amazonaws.firehose#SecurityGroupIdList": { "type": "list", "member": { @@ -5930,8 +6000,7 @@ "PrivateKey": { "target": "com.amazonaws.firehose#SnowflakePrivateKey", "traits": { - "smithy.api#documentation": "

The private key used to encrypt your Snowflake client. For information, see Using Key Pair Authentication & Key Rotation.

", - "smithy.api#required": {} + "smithy.api#documentation": "

The private key used to encrypt your Snowflake client. For information, see Using Key Pair Authentication & Key Rotation.

" } }, "KeyPassphrase": { @@ -5943,8 +6012,7 @@ "User": { "target": "com.amazonaws.firehose#SnowflakeUser", "traits": { - "smithy.api#documentation": "

User login name for the Snowflake account.

", - "smithy.api#required": {} + "smithy.api#documentation": "

User login name for the Snowflake account.

" } }, "Database": { @@ -6028,6 +6096,12 @@ "traits": { "smithy.api#required": {} } + }, + "SecretsManagerConfiguration": { + "target": "com.amazonaws.firehose#SecretsManagerConfiguration", + "traits": { + "smithy.api#documentation": "

\n The configuration that defines how you access secrets for Snowflake.\n

" + } } }, "traits": { @@ -6123,6 +6197,12 @@ }, "S3DestinationDescription": { "target": "com.amazonaws.firehose#S3DestinationDescription" + }, + "SecretsManagerConfiguration": { + "target": "com.amazonaws.firehose#SecretsManagerConfiguration", + "traits": { + "smithy.api#documentation": "

\n The configuration that defines how you access secrets for Snowflake.\n

" + } } }, "traits": { @@ -6224,6 +6304,12 @@ }, "S3Update": { "target": "com.amazonaws.firehose#S3DestinationUpdate" + }, + "SecretsManagerConfiguration": { + "target": "com.amazonaws.firehose#SecretsManagerConfiguration", + "traits": { + "smithy.api#documentation": "

\n Describes the Secrets Manager configuration in Snowflake.\n

" + } } }, "traits": { @@ -6465,8 +6551,7 @@ "HECToken": { "target": "com.amazonaws.firehose#HECToken", "traits": { - "smithy.api#documentation": "

This is a GUID that you obtain from your Splunk cluster when you create a new HEC\n endpoint.

", - "smithy.api#required": {} + "smithy.api#documentation": "

This is a GUID that you obtain from your Splunk cluster when you create a new HEC\n endpoint.

" } }, "HECAcknowledgmentTimeoutInSeconds": { @@ -6511,6 +6596,12 @@ "traits": { "smithy.api#documentation": "

The buffering options. If no value is specified, the default values for Splunk are used.

" } + }, + "SecretsManagerConfiguration": { + "target": "com.amazonaws.firehose#SecretsManagerConfiguration", + "traits": { + "smithy.api#documentation": "

\n The configuration that defines how you access secrets for Splunk.\n

" + } } }, "traits": { @@ -6579,6 +6670,12 @@ "traits": { "smithy.api#documentation": "

The buffering options. If no value is specified, the default values for Splunk are used.

" } + }, + "SecretsManagerConfiguration": { + "target": "com.amazonaws.firehose#SecretsManagerConfiguration", + "traits": { + "smithy.api#documentation": "

\n The configuration that defines how you access secrets for Splunk.\n

" + } } }, "traits": { @@ -6647,6 +6744,12 @@ "traits": { "smithy.api#documentation": "

The buffering options. If no value is specified, the default values for Splunk are used.

" } + }, + "SecretsManagerConfiguration": { + "target": "com.amazonaws.firehose#SecretsManagerConfiguration", + "traits": { + "smithy.api#documentation": "

\n The configuration that defines how you access secrets for Splunk.\n

" + } } }, "traits": { @@ -6719,7 +6822,7 @@ } ], "traits": { - "smithy.api#documentation": "

Enables server-side encryption (SSE) for the delivery stream.

\n

This operation is asynchronous. It returns immediately. When you invoke it, Firehose first sets the encryption status of the stream to ENABLING, and then\n to ENABLED. The encryption status of a delivery stream is the\n Status property in DeliveryStreamEncryptionConfiguration.\n If the operation fails, the encryption status changes to ENABLING_FAILED. You\n can continue to read and write data to your delivery stream while the encryption status is\n ENABLING, but the data is not encrypted. It can take up to 5 seconds after\n the encryption status changes to ENABLED before all records written to the\n delivery stream are encrypted. To find out whether a record or a batch of records was\n encrypted, check the response elements PutRecordOutput$Encrypted and\n PutRecordBatchOutput$Encrypted, respectively.

\n

To check the encryption status of a delivery stream, use DescribeDeliveryStream.

\n

Even if encryption is currently enabled for a delivery stream, you can still invoke this\n operation on it to change the ARN of the CMK or both its type and ARN. If you invoke this\n method to change the CMK, and the old CMK is of type CUSTOMER_MANAGED_CMK,\n Firehose schedules the grant it had on the old CMK for retirement. If the new\n CMK is of type CUSTOMER_MANAGED_CMK, Firehose creates a grant\n that enables it to use the new CMK to encrypt and decrypt data and to manage the\n grant.

\n

For the KMS grant creation to be successful, Firehose APIs StartDeliveryStreamEncryption and CreateDeliveryStream should not be called with session credentials that are more than 6 hours old.

\n

If a delivery stream already has encryption enabled and then you invoke this operation\n to change the ARN of the CMK or both its type and ARN and you get\n ENABLING_FAILED, this only means that the attempt to change the CMK failed.\n In this case, encryption remains enabled with the old CMK.

\n

If the encryption status of your delivery stream is ENABLING_FAILED, you\n can invoke this operation again with a valid CMK. The CMK must be enabled and the key\n policy mustn't explicitly deny the permission for Firehose to invoke KMS\n encrypt and decrypt operations.

\n

You can enable SSE for a delivery stream only if it's a delivery stream that uses\n DirectPut as its source.

\n

The StartDeliveryStreamEncryption and\n StopDeliveryStreamEncryption operations have a combined limit of 25 calls\n per delivery stream per 24 hours. For example, you reach the limit if you call\n StartDeliveryStreamEncryption 13 times and\n StopDeliveryStreamEncryption 12 times for the same delivery stream in a\n 24-hour period.

" + "smithy.api#documentation": "

Enables server-side encryption (SSE) for the delivery stream.

\n

This operation is asynchronous. It returns immediately. When you invoke it, Firehose first sets the encryption status of the stream to ENABLING, and then\n to ENABLED. The encryption status of a delivery stream is the\n Status property in DeliveryStreamEncryptionConfiguration.\n If the operation fails, the encryption status changes to ENABLING_FAILED. You\n can continue to read and write data to your delivery stream while the encryption status is\n ENABLING, but the data is not encrypted. It can take up to 5 seconds after\n the encryption status changes to ENABLED before all records written to the\n delivery stream are encrypted. To find out whether a record or a batch of records was\n encrypted, check the response elements PutRecordOutput$Encrypted and\n PutRecordBatchOutput$Encrypted, respectively.

\n

To check the encryption status of a delivery stream, use DescribeDeliveryStream.

\n

Even if encryption is currently enabled for a delivery stream, you can still invoke this\n operation on it to change the ARN of the CMK or both its type and ARN. If you invoke this\n method to change the CMK, and the old CMK is of type CUSTOMER_MANAGED_CMK,\n Firehose schedules the grant it had on the old CMK for retirement. If the new\n CMK is of type CUSTOMER_MANAGED_CMK, Firehose creates a grant\n that enables it to use the new CMK to encrypt and decrypt data and to manage the\n grant.

\n

For the KMS grant creation to be successful, the Firehose API operations\n StartDeliveryStreamEncryption and CreateDeliveryStream should\n not be called with session credentials that are more than 6 hours old.

\n

If a delivery stream already has encryption enabled and then you invoke this operation\n to change the ARN of the CMK or both its type and ARN and you get\n ENABLING_FAILED, this only means that the attempt to change the CMK failed.\n In this case, encryption remains enabled with the old CMK.

\n

If the encryption status of your delivery stream is ENABLING_FAILED, you\n can invoke this operation again with a valid CMK. The CMK must be enabled and the key\n policy mustn't explicitly deny the permission for Firehose to invoke KMS\n encrypt and decrypt operations.

\n

You can enable SSE for a delivery stream only if it's a delivery stream that uses\n DirectPut as its source.

\n

The StartDeliveryStreamEncryption and\n StopDeliveryStreamEncryption operations have a combined limit of 25 calls\n per delivery stream per 24 hours. For example, you reach the limit if you call\n StartDeliveryStreamEncryption 13 times and\n StopDeliveryStreamEncryption 12 times for the same delivery stream in a\n 24-hour period.

" } }, "com.amazonaws.firehose#StartDeliveryStreamEncryptionInput": { @@ -7100,7 +7203,7 @@ "SnowflakeDestinationUpdate": { "target": "com.amazonaws.firehose#SnowflakeDestinationUpdate", "traits": { - "smithy.api#documentation": "

Update to the Snowflake destination condiguration settings

" + "smithy.api#documentation": "

Update to the Snowflake destination configuration settings.

" } } },