Network Firewall now prevents TLS handshakes with the target server until after the Server Name Indication (SNI) has been seen and verified. The monitoring dashboard now provides deeper insights into PrivateLink endpoint candidates and offers filters based on IP addresses and protocol.

aws-sdk-cpp-automation · aws-sdk-cpp-automation · commit a07b83722d9c · 2025-09-17T18:32:13.000Z
Add support for Amazon EC2 Capacity Blocks for ML
Add mac-m4.metal and mac-m4pro.metal instance types.
diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-1.11.649
+1.11.650
diff --git a/generated/src/aws-cpp-sdk-ec2/include/aws/ec2/model/InstanceType.h b/generated/src/aws-cpp-sdk-ec2/include/aws/ec2/model/InstanceType.h
@@ -1031,7 +1031,9 @@ namespace Model
     i8ge_24xlarge,
     i8ge_48xlarge,
     i8ge_metal_24xl,
-    i8ge_metal_48xl
+    i8ge_metal_48xl,
+    mac_m4_metal,
+    mac_m4pro_metal
   };
 
 namespace InstanceTypeMapper
diff --git a/generated/src/aws-cpp-sdk-ec2/source/model/InstanceType.cpp b/generated/src/aws-cpp-sdk-ec2/source/model/InstanceType.cpp
@@ -1036,6 +1036,8 @@ namespace Aws
         static const int i8ge_48xlarge_HASH = HashingUtils::HashString("i8ge.48xlarge");
         static const int i8ge_metal_24xl_HASH = HashingUtils::HashString("i8ge.metal-24xl");
         static const int i8ge_metal_48xl_HASH = HashingUtils::HashString("i8ge.metal-48xl");
+        static const int mac_m4_metal_HASH = HashingUtils::HashString("mac-m4.metal");
+        static const int mac_m4pro_metal_HASH = HashingUtils::HashString("mac-m4pro.metal");
 
         /*
         The if-else chains in this file are converted into a jump table by the compiler,
@@ -6156,6 +6158,16 @@ namespace Aws
             enumValue = InstanceType::i8ge_metal_48xl;
             return true;
           }
+          else if (hashCode == mac_m4_metal_HASH)
+          {
+            enumValue = InstanceType::mac_m4_metal;
+            return true;
+          }
+          else if (hashCode == mac_m4pro_metal_HASH)
+          {
+            enumValue = InstanceType::mac_m4pro_metal;
+            return true;
+          }
           return false;
         }
 
@@ -9275,6 +9287,12 @@ namespace Aws
           case InstanceType::i8ge_metal_48xl:
             value = "i8ge.metal-48xl";
             return true;
+          case InstanceType::mac_m4_metal:
+            value = "mac-m4.metal";
+            return true;
+          case InstanceType::mac_m4pro_metal:
+            value = "mac-m4pro.metal";
+            return true;
           default:
             return false;
           }
diff --git a/generated/src/aws-cpp-sdk-network-firewall/include/aws/network-firewall/NetworkFirewallClient.h b/generated/src/aws-cpp-sdk-network-firewall/include/aws/network-firewall/NetworkFirewallClient.h
@@ -498,7 +498,7 @@ namespace NetworkFirewall
         /**
          * <p>Deletes a transit gateway attachment from a Network Firewall. Either the
          * firewall owner or the transit gateway owner can delete the attachment.</p>
-         *  <p>After you delete a transit gateway attachment, raffic will no
+         *  <p>After you delete a transit gateway attachment, traffic will no
          * longer flow through the firewall endpoints.</p>  <p>After you
          * initiate the delete operation, use <a>DescribeFirewall</a> to monitor the
          * deletion status.</p><p><h3>See Also:</h3>   <a
@@ -1325,8 +1325,8 @@ namespace NetworkFirewall
          * <p>Rejects a transit gateway attachment request for Network Firewall. When you
          * reject the attachment request, Network Firewall cancels the creation of routing
          * components between the transit gateway and firewall endpoints.</p> <p>Only the
-         * firewall owner can reject the attachment. After rejection, no traffic will flow
-         * through the firewall endpoints for this attachment.</p> <p>Use
+         * transit gateway owner can reject the attachment. After rejection, no traffic
+         * will flow through the firewall endpoints for this attachment.</p> <p>Use
          * <a>DescribeFirewall</a> to monitor the rejection status. To accept the
          * attachment instead of rejecting it, use
          * <a>AcceptNetworkFirewallTransitGatewayAttachment</a>.</p>  <p>Once
diff --git a/generated/src/aws-cpp-sdk-network-firewall/include/aws/network-firewall/model/CreateFirewallRequest.h b/generated/src/aws-cpp-sdk-network-firewall/include/aws/network-firewall/model/CreateFirewallRequest.h
@@ -217,8 +217,8 @@ namespace Model
      * <p>Required. The Availability Zones where you want to create firewall endpoints
      * for a transit gateway-attached firewall. You must specify at least one
      * Availability Zone. Consider enabling the firewall in every Availability Zone
-     * where you have workloads to maintain Availability Zone independence.</p> <p>You
-     * can modify Availability Zones later using <a>AssociateAvailabilityZones</a> or
+     * where you have workloads to maintain Availability Zone isolation.</p> <p>You can
+     * modify Availability Zones later using <a>AssociateAvailabilityZones</a> or
      * <a>DisassociateAvailabilityZones</a>, but this may briefly disrupt traffic. The
      * <code>AvailabilityZoneChangeProtection</code> setting controls whether you can
      * make these modifications.</p>
diff --git a/generated/src/aws-cpp-sdk-network-firewall/include/aws/network-firewall/model/FirewallPolicy.h b/generated/src/aws-cpp-sdk-network-firewall/include/aws/network-firewall/model/FirewallPolicy.h
@@ -201,6 +201,18 @@ namespace Model
     template<typename PolicyVariablesT = PolicyVariables>
     FirewallPolicy& WithPolicyVariables(PolicyVariablesT&& value) { SetPolicyVariables(std::forward<PolicyVariablesT>(value)); return *this;}
     ///@}
+
+    ///@{
+    /**
+     * <p>When true, prevents TCP and TLS packets from reaching destination servers
+     * until TLS Inspection has evaluated Server Name Indication (SNI) rules. Requires
+     * an associated TLS Inspection configuration.</p>
+     */
+    inline bool GetEnableTLSSessionHolding() const { return m_enableTLSSessionHolding; }
+    inline bool EnableTLSSessionHoldingHasBeenSet() const { return m_enableTLSSessionHoldingHasBeenSet; }
+    inline void SetEnableTLSSessionHolding(bool value) { m_enableTLSSessionHoldingHasBeenSet = true; m_enableTLSSessionHolding = value; }
+    inline FirewallPolicy& WithEnableTLSSessionHolding(bool value) { SetEnableTLSSessionHolding(value); return *this;}
+    ///@}
   private:
 
     Aws::Vector<StatelessRuleGroupReference> m_statelessRuleGroupReferences;
@@ -229,6 +241,9 @@ namespace Model
 
     PolicyVariables m_policyVariables;
     bool m_policyVariablesHasBeenSet = false;
+
+    bool m_enableTLSSessionHolding{false};
+    bool m_enableTLSSessionHoldingHasBeenSet = false;
   };
 
 } // namespace Model
diff --git a/generated/src/aws-cpp-sdk-network-firewall/source/model/FirewallPolicy.cpp b/generated/src/aws-cpp-sdk-network-firewall/source/model/FirewallPolicy.cpp
@@ -94,6 +94,11 @@ FirewallPolicy& FirewallPolicy::operator =(JsonView jsonValue)
     m_policyVariables = jsonValue.GetObject("PolicyVariables");
     m_policyVariablesHasBeenSet = true;
   }
+  if(jsonValue.ValueExists("EnableTLSSessionHolding"))
+  {
+    m_enableTLSSessionHolding = jsonValue.GetBool("EnableTLSSessionHolding");
+    m_enableTLSSessionHoldingHasBeenSet = true;
+  }
   return *this;
 }
 
@@ -185,6 +190,12 @@ JsonValue FirewallPolicy::Jsonize() const
 
   }
 
+  if(m_enableTLSSessionHoldingHasBeenSet)
+  {
+   payload.WithBool("EnableTLSSessionHolding", m_enableTLSSessionHolding);
+
+  }
+
   return payload;
 }
 
diff --git a/generated/src/aws-cpp-sdk-pcs/include/aws/pcs/model/ComputeNodeGroup.h b/generated/src/aws-cpp-sdk-pcs/include/aws/pcs/model/ComputeNodeGroup.h
@@ -171,10 +171,15 @@ namespace Model
 
     ///@{
     /**
-     * <p>Specifies how EC2 instances are purchased on your behalf. Amazon Web Services
-     * PCS supports On-Demand and Spot instances. For more information, see <a
-     * href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-purchasing-options.html">Instance
-     * purchasing options</a> in the <i>Amazon Elastic Compute Cloud User Guide</i>. If
+     * <p>Specifies how EC2 instances are purchased on your behalf. PCS supports
+     * On-Demand Instances, Spot Instances, and Amazon EC2 Capacity Blocks for ML. For
+     * more information, see <a
+     * href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-purchasing-options.html">Amazon
+     * EC2 billing and purchasing options</a> in the <i>Amazon Elastic Compute Cloud
+     * User Guide</i>. For more information about PCS support for Capacity Blocks, see
+     * <a
+     * href="https://docs.aws.amazon.com/pcs/latest/userguide/capacity-blocks.html">Using
+     * Amazon EC2 Capacity Blocks for ML with PCS</a> in the <i>PCS User Guide</i>. If
      * you don't provide this option, it defaults to On-Demand.</p>
      */
     inline PurchaseOption GetPurchaseOption() const { return m_purchaseOption; }
@@ -223,8 +228,8 @@ namespace Model
 
     ///@{
     /**
-     * <p>A list of EC2 instance configurations that Amazon Web Services PCS can
-     * provision in the compute node group.</p>
+     * <p>A list of EC2 instance configurations that PCS can provision in the compute
+     * node group.</p>
      */
     inline const Aws::Vector<InstanceConfig>& GetInstanceConfigs() const { return m_instanceConfigs; }
     inline bool InstanceConfigsHasBeenSet() const { return m_instanceConfigsHasBeenSet; }
diff --git a/generated/src/aws-cpp-sdk-pcs/include/aws/pcs/model/CreateComputeNodeGroupRequest.h b/generated/src/aws-cpp-sdk-pcs/include/aws/pcs/model/CreateComputeNodeGroupRequest.h
@@ -98,10 +98,15 @@ namespace Model
 
     ///@{
     /**
-     * <p>Specifies how EC2 instances are purchased on your behalf. Amazon Web Services
-     * PCS supports On-Demand and Spot instances. For more information, see <a
-     * href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-purchasing-options.html">Instance
-     * purchasing options</a> in the <i>Amazon Elastic Compute Cloud User Guide</i>. If
+     * <p>Specifies how EC2 instances are purchased on your behalf. PCS supports
+     * On-Demand Instances, Spot Instances, and Amazon EC2 Capacity Blocks for ML. For
+     * more information, see <a
+     * href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-purchasing-options.html">Amazon
+     * EC2 billing and purchasing options</a> in the <i>Amazon Elastic Compute Cloud
+     * User Guide</i>. For more information about PCS support for Capacity Blocks, see
+     * <a
+     * href="https://docs.aws.amazon.com/pcs/latest/userguide/capacity-blocks.html">Using
+     * Amazon EC2 Capacity Blocks for ML with PCS</a> in the <i>PCS User Guide</i>. If
      * you don't provide this option, it defaults to On-Demand.</p>
      */
     inline PurchaseOption GetPurchaseOption() const { return m_purchaseOption; }
@@ -152,8 +157,8 @@ namespace Model
 
     ///@{
     /**
-     * <p>A list of EC2 instance configurations that Amazon Web Services PCS can
-     * provision in the compute node group.</p>
+     * <p>A list of EC2 instance configurations that PCS can provision in the compute
+     * node group.</p>
      */
     inline const Aws::Vector<InstanceConfig>& GetInstanceConfigs() const { return m_instanceConfigs; }
     inline bool InstanceConfigsHasBeenSet() const { return m_instanceConfigsHasBeenSet; }
diff --git a/generated/src/aws-cpp-sdk-pcs/include/aws/pcs/model/NetworkingRequest.h b/generated/src/aws-cpp-sdk-pcs/include/aws/pcs/model/NetworkingRequest.h
@@ -42,12 +42,11 @@ namespace Model
 
     ///@{
     /**
-     * <p>The list of subnet IDs where Amazon Web Services PCS creates an Elastic
-     * Network Interface (ENI) to enable communication between managed controllers and
-     * Amazon Web Services PCS resources. Subnet IDs have the form
-     * <code>subnet-0123456789abcdef0</code>.</p> <p>Subnets can't be in Outposts,
-     * Wavelength or an Amazon Web Services Local Zone.</p>  <p>Amazon Web
-     * Services PCS currently supports only 1 subnet in this list.</p> 
+     * <p>The list of subnet IDs where PCS creates an Elastic Network Interface (ENI)
+     * to enable communication between managed controllers and PCS resources. Subnet
+     * IDs have the form <code>subnet-0123456789abcdef0</code>.</p> <p>Subnets can't be
+     * in Outposts, Wavelength or an Amazon Web Services Local Zone.</p>  <p>PCS
+     * currently supports only 1 subnet in this list.</p> 
      */
     inline const Aws::Vector<Aws::String>& GetSubnetIds() const { return m_subnetIds; }
     inline bool SubnetIdsHasBeenSet() const { return m_subnetIdsHasBeenSet; }
diff --git a/generated/src/aws-cpp-sdk-pcs/include/aws/pcs/model/PurchaseOption.h b/generated/src/aws-cpp-sdk-pcs/include/aws/pcs/model/PurchaseOption.h
@@ -17,7 +17,8 @@ namespace Model
   {
     NOT_SET,
     ONDEMAND,
-    SPOT
+    SPOT,
+    CAPACITY_BLOCK
   };
 
 namespace PurchaseOptionMapper
diff --git a/generated/src/aws-cpp-sdk-pcs/include/aws/pcs/model/SlurmAuthKey.h b/generated/src/aws-cpp-sdk-pcs/include/aws/pcs/model/SlurmAuthKey.h
@@ -40,7 +40,7 @@ namespace Model
 
     ///@{
     /**
-     * <p>The Amazon Resource Name (ARN) of the the shared Slurm key.</p>
+     * <p>The Amazon Resource Name (ARN) of the shared Slurm key.</p>
      */
     inline const Aws::String& GetSecretArn() const { return m_secretArn; }
     inline bool SecretArnHasBeenSet() const { return m_secretArnHasBeenSet; }
diff --git a/generated/src/aws-cpp-sdk-pcs/include/aws/pcs/model/SpotOptions.h b/generated/src/aws-cpp-sdk-pcs/include/aws/pcs/model/SpotOptions.h
@@ -41,9 +41,9 @@ namespace Model
 
     ///@{
     /**
-     * <p>The Amazon EC2 allocation strategy Amazon Web Services PCS uses to provision
-     * EC2 instances. Amazon Web Services PCS supports <b>lowest price</b>, <b>capacity
-     * optimized</b>, and <b>price capacity optimized</b>. For more information, see <a
+     * <p>The Amazon EC2 allocation strategy PCS uses to provision EC2 instances. PCS
+     * supports <b>lowest price</b>, <b>capacity optimized</b>, and <b>price capacity
+     * optimized</b>. For more information, see <a
      * href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-fleet-allocation-strategy.html">Use
      * allocation strategies to determine how EC2 Fleet or Spot Fleet fulfills Spot and
      * On-Demand capacity</a> in the <i>Amazon Elastic Compute Cloud User Guide</i>. If
diff --git a/generated/src/aws-cpp-sdk-pcs/include/aws/pcs/model/UpdateComputeNodeGroupRequest.h b/generated/src/aws-cpp-sdk-pcs/include/aws/pcs/model/UpdateComputeNodeGroupRequest.h
@@ -106,10 +106,15 @@ namespace Model
 
     ///@{
     /**
-     * <p>Specifies how EC2 instances are purchased on your behalf. Amazon Web Services
-     * PCS supports On-Demand and Spot instances. For more information, see <a
-     * href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-purchasing-options.html">Instance
-     * purchasing options</a> in the <i>Amazon Elastic Compute Cloud User Guide</i>. If
+     * <p>Specifies how EC2 instances are purchased on your behalf. PCS supports
+     * On-Demand Instances, Spot Instances, and Amazon EC2 Capacity Blocks for ML. For
+     * more information, see <a
+     * href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-purchasing-options.html">Amazon
+     * EC2 billing and purchasing options</a> in the <i>Amazon Elastic Compute Cloud
+     * User Guide</i>. For more information about PCS support for Capacity Blocks, see
+     * <a
+     * href="https://docs.aws.amazon.com/pcs/latest/userguide/capacity-blocks.html">Using
+     * Amazon EC2 Capacity Blocks for ML with PCS</a> in the <i>PCS User Guide</i>. If
      * you don't provide this option, it defaults to On-Demand.</p>
      */
     inline PurchaseOption GetPurchaseOption() const { return m_purchaseOption; }
diff --git a/generated/src/aws-cpp-sdk-pcs/source/model/PurchaseOption.cpp b/generated/src/aws-cpp-sdk-pcs/source/model/PurchaseOption.cpp
@@ -22,6 +22,7 @@ namespace Aws
 
         static const int ONDEMAND_HASH = HashingUtils::HashString("ONDEMAND");
         static const int SPOT_HASH = HashingUtils::HashString("SPOT");
+        static const int CAPACITY_BLOCK_HASH = HashingUtils::HashString("CAPACITY_BLOCK");
 
 
         PurchaseOption GetPurchaseOptionForName(const Aws::String& name)
@@ -35,6 +36,10 @@ namespace Aws
           {
             return PurchaseOption::SPOT;
           }
+          else if (hashCode == CAPACITY_BLOCK_HASH)
+          {
+            return PurchaseOption::CAPACITY_BLOCK;
+          }
           EnumParseOverflowContainer* overflowContainer = Aws::GetEnumOverflowContainer();
           if(overflowContainer)
           {
@@ -55,6 +60,8 @@ namespace Aws
             return "ONDEMAND";
           case PurchaseOption::SPOT:
             return "SPOT";
+          case PurchaseOption::CAPACITY_BLOCK:
+            return "CAPACITY_BLOCK";
           default:
             EnumParseOverflowContainer* overflowContainer = Aws::GetEnumOverflowContainer();
             if(overflowContainer)
diff --git a/src/aws-cpp-sdk-core/include/aws/core/VersionConfig.h b/src/aws-cpp-sdk-core/include/aws/core/VersionConfig.h
@@ -4,7 +4,7 @@
  */
 #pragma once
 
-#define AWS_SDK_VERSION_STRING "1.11.649"
+#define AWS_SDK_VERSION_STRING "1.11.650"
 #define AWS_SDK_VERSION_MAJOR 1
 #define AWS_SDK_VERSION_MINOR 11
-#define AWS_SDK_VERSION_PATCH 649
+#define AWS_SDK_VERSION_PATCH 650
diff --git a/tools/code-generation/api-descriptions/ec2-2016-11-15.normal.json b/tools/code-generation/api-descriptions/ec2-2016-11-15.normal.json
@@ -42529,7 +42529,9 @@
         "i8ge.24xlarge",
         "i8ge.48xlarge",
         "i8ge.metal-24xl",
-        "i8ge.metal-48xl"
+        "i8ge.metal-48xl",
+        "mac-m4.metal",
+        "mac-m4pro.metal"
       ]
     },
     "InstanceTypeHypervisor":{
diff --git a/tools/code-generation/api-descriptions/network-firewall-2020-11-12.normal.json b/tools/code-generation/api-descriptions/network-firewall-2020-11-12.normal.json
@@ -226,7 +226,7 @@
         {"shape":"ResourceNotFoundException"},
         {"shape":"ThrottlingException"}
       ],
-      "documentation":"<p>Deletes a transit gateway attachment from a Network Firewall. Either the firewall owner or the transit gateway owner can delete the attachment.</p> <important> <p>After you delete a transit gateway attachment, raffic will no longer flow through the firewall endpoints.</p> </important> <p>After you initiate the delete operation, use <a>DescribeFirewall</a> to monitor the deletion status.</p>"
+      "documentation":"<p>Deletes a transit gateway attachment from a Network Firewall. Either the firewall owner or the transit gateway owner can delete the attachment.</p> <important> <p>After you delete a transit gateway attachment, traffic will no longer flow through the firewall endpoints.</p> </important> <p>After you initiate the delete operation, use <a>DescribeFirewall</a> to monitor the deletion status.</p>"
     },
     "DeleteResourcePolicy":{
       "name":"DeleteResourcePolicy",
@@ -695,7 +695,7 @@
         {"shape":"ResourceNotFoundException"},
         {"shape":"ThrottlingException"}
       ],
-      "documentation":"<p>Rejects a transit gateway attachment request for Network Firewall. When you reject the attachment request, Network Firewall cancels the creation of routing components between the transit gateway and firewall endpoints.</p> <p>Only the firewall owner can reject the attachment. After rejection, no traffic will flow through the firewall endpoints for this attachment.</p> <p>Use <a>DescribeFirewall</a> to monitor the rejection status. To accept the attachment instead of rejecting it, use <a>AcceptNetworkFirewallTransitGatewayAttachment</a>.</p> <note> <p>Once rejected, you cannot reverse this action. To establish connectivity, you must create a new transit gateway-attached firewall.</p> </note>"
+      "documentation":"<p>Rejects a transit gateway attachment request for Network Firewall. When you reject the attachment request, Network Firewall cancels the creation of routing components between the transit gateway and firewall endpoints.</p> <p>Only the transit gateway owner can reject the attachment. After rejection, no traffic will flow through the firewall endpoints for this attachment.</p> <p>Use <a>DescribeFirewall</a> to monitor the rejection status. To accept the attachment instead of rejecting it, use <a>AcceptNetworkFirewallTransitGatewayAttachment</a>.</p> <note> <p>Once rejected, you cannot reverse this action. To establish connectivity, you must create a new transit gateway-attached firewall.</p> </note>"
     },
     "StartAnalysisReport":{
       "name":"StartAnalysisReport",
@@ -1522,7 +1522,7 @@
         },
         "AvailabilityZoneMappings":{
           "shape":"AvailabilityZoneMappings",
-          "documentation":"<p>Required. The Availability Zones where you want to create firewall endpoints for a transit gateway-attached firewall. You must specify at least one Availability Zone. Consider enabling the firewall in every Availability Zone where you have workloads to maintain Availability Zone independence.</p> <p>You can modify Availability Zones later using <a>AssociateAvailabilityZones</a> or <a>DisassociateAvailabilityZones</a>, but this may briefly disrupt traffic. The <code>AvailabilityZoneChangeProtection</code> setting controls whether you can make these modifications.</p>"
+          "documentation":"<p>Required. The Availability Zones where you want to create firewall endpoints for a transit gateway-attached firewall. You must specify at least one Availability Zone. Consider enabling the firewall in every Availability Zone where you have workloads to maintain Availability Zone isolation.</p> <p>You can modify Availability Zones later using <a>AssociateAvailabilityZones</a> or <a>DisassociateAvailabilityZones</a>, but this may briefly disrupt traffic. The <code>AvailabilityZoneChangeProtection</code> setting controls whether you can make these modifications.</p>"
         },
         "AvailabilityZoneChangeProtection":{
           "shape":"Boolean",
@@ -2410,6 +2410,7 @@
     },
     "Domain":{"type":"string"},
     "EnableMonitoringDashboard":{"type":"boolean"},
+    "EnableTLSSessionHolding":{"type":"boolean"},
     "EnabledAnalysisType":{
       "type":"string",
       "enum":[
@@ -2594,6 +2595,10 @@
         "PolicyVariables":{
           "shape":"PolicyVariables",
           "documentation":"<p>Contains variables that you can use to override default Suricata settings in your firewall policy.</p>"
+        },
+        "EnableTLSSessionHolding":{
+          "shape":"EnableTLSSessionHolding",
+          "documentation":"<p>When true, prevents TCP and TLS packets from reaching destination servers until TLS Inspection has evaluated Server Name Indication (SNI) rules. Requires an associated TLS Inspection configuration.</p>"
         }
       },
       "documentation":"<p>The firewall policy defines the behavior of a firewall using a collection of stateless and stateful rule groups and other settings. You can use one firewall policy for multiple firewalls. </p> <p>This, along with <a>FirewallPolicyResponse</a>, define the policy. You can retrieve all objects for a firewall policy by calling <a>DescribeFirewallPolicy</a>.</p>"
diff --git a/tools/code-generation/api-descriptions/pcs-2023-02-10.normal.json b/tools/code-generation/api-descriptions/pcs-2023-02-10.normal.json
diff --git a/tools/code-generation/smithy/codegen/cpp-smoke-tests/smithy-build.json b/tools/code-generation/smithy/codegen/cpp-smoke-tests/smithy-build.json

Original file line number	Diff line number	Diff line change
`@@ -94,6 +94,11 @@ FirewallPolicy& FirewallPolicy::operator =(JsonView jsonValue)`
`94`	`94`	`m_policyVariables = jsonValue.GetObject("PolicyVariables");`
`95`	`95`	`m_policyVariablesHasBeenSet = true;`
`96`	`96`	`}`
	`97`	`+ if(jsonValue.ValueExists("EnableTLSSessionHolding"))`
	`98`	`+ {`
	`99`	`+ m_enableTLSSessionHolding = jsonValue.GetBool("EnableTLSSessionHolding");`
	`100`	`+ m_enableTLSSessionHoldingHasBeenSet = true;`
	`101`	`+ }`
`97`	`102`	`return *this;`
`98`	`103`	`}`
`99`	`104`
`@@ -185,6 +190,12 @@ JsonValue FirewallPolicy::Jsonize() const`
`185`	`190`
`186`	`191`	`}`
`187`	`192`
	`193`	`+ if(m_enableTLSSessionHoldingHasBeenSet)`
	`194`	`+ {`
	`195`	`+ payload.WithBool("EnableTLSSessionHolding", m_enableTLSSessionHolding);`
	`196`	`+`
	`197`	`+ }`
	`198`	`+`
`188`	`199`	`return payload;`
`189`	`200`	`}`
`190`	`201`