Amazon Kinesis Firehose Update: Updates Amazon Firehose documentation for message regarding Enforcing Tags IAM Policy.

Author: AWS

.changes/next-release/feature-AmazonKinesisFirehose-3edad09.json

@@ -0,0 +1,6 @@
+{
+    "type": "feature",
+    "category": "Amazon Kinesis Firehose",
+    "contributor": "",
+    "description": "Updates Amazon Firehose documentation for message regarding Enforcing Tags IAM Policy."
+}

services/firehose/src/main/resources/codegen-resources/service-2.json

@@ -777,7 +777,7 @@
         },
         "Tags":{
           "shape":"TagDeliveryStreamInputTagList",
-          "documentation":"<p>A set of tags to assign to the delivery stream. A tag is a key-value pair that you can define and assign to Amazon Web Services resources. Tags are metadata. For example, you can add friendly names and descriptions or other types of information that can help you distinguish the delivery stream. For more information about tags, see <a href=\"https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html\">Using Cost Allocation Tags</a> in the Amazon Web Services Billing and Cost Management User Guide.</p> <p>You can specify up to 50 tags when creating a delivery stream.</p>"
+          "documentation":"<p>A set of tags to assign to the delivery stream. A tag is a key-value pair that you can define and assign to Amazon Web Services resources. Tags are metadata. For example, you can add friendly names and descriptions or other types of information that can help you distinguish the delivery stream. For more information about tags, see <a href=\"https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html\">Using Cost Allocation Tags</a> in the Amazon Web Services Billing and Cost Management User Guide.</p> <p>You can specify up to 50 tags when creating a delivery stream.</p> <p>If you specify tags in the <code>CreateDeliveryStream</code> action, Amazon Data Firehose performs an additional authorization on the <code>firehose:TagDeliveryStream</code> action to verify if users have permissions to create tags. If you do not provide this permission, requests to create new Firehose delivery streams with IAM resource tags will fail with an <code>AccessDeniedException</code> such as following.</p> <p> <b>AccessDeniedException</b> </p> <p>User: arn:aws:sts::x:assumed-role/x/x is not authorized to perform: firehose:TagDeliveryStream on resource: arn:aws:firehose:us-east-1:x:deliverystream/x with an explicit deny in an identity-based policy.</p> <p>For an example IAM policy, see <a href=\"https://docs.aws.amazon.com/firehose/latest/APIReference/API_CreateDeliveryStream.html#API_CreateDeliveryStream_Examples\">Tag example.</a> </p>"
         },
         "AmazonOpenSearchServerlessDestinationConfiguration":{
           "shape":"AmazonOpenSearchServerlessDestinationConfiguration",
@@ -3844,5 +3844,5 @@
       "documentation":"<p>The details of the VPC of the Amazon ES destination.</p>"
     }
   },
-  "documentation":"<fullname>Amazon Data Firehose</fullname> <p>Amazon Data Firehose is a fully managed service that delivers real-time streaming data to destinations such as Amazon Simple Storage Service (Amazon S3), Amazon OpenSearch Service, Amazon Redshift, Splunk, and various other supportd destinations.</p>"
+  "documentation":"<fullname>Amazon Data Firehose</fullname> <note> <p>Amazon Data Firehose was previously known as Amazon Kinesis Data Firehose.</p> </note> <p>Amazon Data Firehose is a fully managed service that delivers real-time streaming data to destinations such as Amazon Simple Storage Service (Amazon S3), Amazon OpenSearch Service, Amazon Redshift, Splunk, and various other supportd destinations.</p>"
 }