feat(sources): update documentation

[aws-cdk-automation]

⚠️ This Pull Request updates daily and will overwrite all manual changes pushed to the branch

Updates the documentation source from upstream. See details in workflow run.

---

Automatically created by projen via the "update-source-documentation" workflow

[github-actions]

To work on this Pull Request, please create a new branch and PR. This prevents your work from being deleted by the automation.

Run the following commands inside the repo:

gh co 2236
git switch -c fix-pr-2236 && git push -u origin HEAD
gh pr create -t "fix: PR #2236" --body "Fixes https://github.com/cdklabs/awscdk-service-spec/pull/2236"

[github-actions]

@aws-cdk/aws-service-spec: Model database diff detected
📁 Download full diff

├[~] service aws-apigateway
│ └ resources
│    ├[~]  resource AWS::ApiGateway::DomainName
│    │  └ properties
│    │     └ EndpointAccessMode: (documentation changed)
│    ├[~]  resource AWS::ApiGateway::DomainNameV2
│    │  └ properties
│    │     └ EndpointAccessMode: (documentation changed)
│    ├[~]  resource AWS::ApiGateway::Method
│    │  └ types
│    │     └[~] type Integration
│    │       └ properties
│    │          ├ IntegrationTarget: (documentation changed)
│    │          └ ResponseTransferMode: (documentation changed)
│    └[~]  resource AWS::ApiGateway::RestApi
│       └ properties
│          ├ EndpointAccessMode: (documentation changed)
│          └ SecurityPolicy: (documentation changed)
├[~] service aws-backup
│ └ resources
│    └[~]  resource AWS::Backup::ReportPlan
│       └ types
│          └[~] type ReportSetting
│            └ properties
│               └ ReportTemplate: (documentation changed)
├[~] service aws-bedrock
│ └ resources
│    └[~]  resource AWS::Bedrock::DataAutomationProject
│       └ types
│          ├[~] type AudioLanguageConfiguration
│          │ ├      - documentation: undefined
│          │ │      + documentation: This allows you to set the input and output language of your audio. The input language can be set to any of the languages supported by Bedrock Data Automation. The output can either be set to english or whatever the dominant language is of the audio, determined by the language spoken for the most seconds.
│          │ └ properties
│          │    ├ GenerativeOutputLanguage: (documentation changed)
│          │    ├ IdentifyMultipleLanguages: (documentation changed)
│          │    └ InputLanguages: (documentation changed)
│          └[~] type AudioOverrideConfiguration
│            └ properties
│               └ LanguageConfiguration: (documentation changed)
├[~] service aws-ce
│ └ resources
│    └[~]  resource AWS::CE::AnomalyMonitor
│       └ properties
│          ├ MonitorDimension: (documentation changed)
│          └ MonitorType: (documentation changed)
├[~] service aws-codedeploy
│ └ resources
│    └[~]  resource AWS::CodeDeploy::DeploymentGroup
│       ├ properties
│       │  └ TerminationHookEnabled: (documentation changed)
│       └ types
│          └[~] type GreenFleetProvisioningOption
│            └ properties
│               └ Action: (documentation changed)
├[~] service aws-dsql
│ └ resources
│    └[~]  resource AWS::DSQL::Cluster
│       └ attributes
│          └ Endpoint: (documentation changed)
├[~] service aws-ec2
│ └ resources
│    ├[~]  resource AWS::EC2::TransitGateway
│    │  └ properties
│    │     └ EncryptionSupport: (documentation changed)
│    └[~]  resource AWS::EC2::VPCEndpoint
│       └ types
│          └[~] type DnsOptionsSpecification
│            └ properties
│               ├ PrivateDnsPreference: (documentation changed)
│               └ PrivateDnsSpecifiedDomains: (documentation changed)
├[~] service aws-eks
│ └ resources
│    ├[~]  resource AWS::EKS::Cluster
│    │  └      - documentation: Creates an Amazon EKS control plane.
│    │         The Amazon EKS control plane consists of control plane instances that run the Kubernetes software, such as `etcd` and the API server. The control plane runs in an account managed by AWS , and the Kubernetes API is exposed by the Amazon EKS API server endpoint. Each Amazon EKS cluster control plane is single tenant and unique. It runs on its own set of Amazon EC2 instances.
│    │         The cluster control plane is provisioned across multiple Availability Zones and fronted by an Elastic Load Balancing Network Load Balancer. Amazon EKS also provisions elastic network interfaces in your VPC subnets to provide connectivity from the control plane instances to the nodes (for example, to support `kubectl exec` , `logs` , and `proxy` data flows).
│    │         Amazon EKS nodes run in your AWS account and connect to your cluster's control plane over the Kubernetes API server endpoint and a certificate file that is created for your cluster.
│    │         You can use the `endpointPublicAccess` and `endpointPrivateAccess` parameters to enable or disable public and private access to your cluster's Kubernetes API server endpoint. By default, public access is enabled, and private access is disabled. The endpoint domain name and IP address family depends on the value of the `ipFamily` for the cluster. For more information, see [Amazon EKS Cluster Endpoint Access Control](https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html) in the **Amazon EKS User Guide** .
│    │         You can use the `logging` parameter to enable or disable exporting the Kubernetes control plane logs for your cluster to CloudWatch Logs. By default, cluster control plane logs aren't exported to CloudWatch Logs. For more information, see [Amazon EKS Cluster Control Plane Logs](https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html) in the **Amazon EKS User Guide** .
│    │         > CloudWatch Logs ingestion, archive storage, and data scanning rates apply to exported control plane logs. For more information, see [CloudWatch Pricing](https://docs.aws.amazon.com/cloudwatch/pricing/) . 
│    │         In most cases, it takes several minutes to create a cluster. After you create an Amazon EKS cluster, you must configure your Kubernetes tooling to communicate with the API server and launch nodes into your cluster. For more information, see [Allowing users to access your cluster](https://docs.aws.amazon.com/eks/latest/userguide/cluster-auth.html) and [Launching Amazon EKS nodes](https://docs.aws.amazon.com/eks/latest/userguide/launch-workers.html) in the *Amazon EKS User Guide* .
│    │         + documentation: Creates an Amazon EKS control plane.
│    │         The Amazon EKS control plane consists of control plane instances that run the Kubernetes software, such as `etcd` and the API server. The control plane runs in an account managed by AWS , and the Kubernetes API is exposed by the Amazon EKS API server endpoint. Each Amazon EKS cluster control plane is single tenant and unique. It runs on its own set of Amazon EC2 instances.
│    │         The cluster control plane is provisioned across multiple Availability Zones and fronted by an ELB Network Load Balancer. Amazon EKS also provisions elastic network interfaces in your VPC subnets to provide connectivity from the control plane instances to the nodes (for example, to support `kubectl exec` , `logs` , and `proxy` data flows).
│    │         Amazon EKS nodes run in your AWS account and connect to your cluster's control plane over the Kubernetes API server endpoint and a certificate file that is created for your cluster.
│    │         You can use the `endpointPublicAccess` and `endpointPrivateAccess` parameters to enable or disable public and private access to your cluster's Kubernetes API server endpoint. By default, public access is enabled, and private access is disabled. The endpoint domain name and IP address family depends on the value of the `ipFamily` for the cluster. For more information, see [Amazon EKS Cluster Endpoint Access Control](https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html) in the **Amazon EKS User Guide** .
│    │         You can use the `logging` parameter to enable or disable exporting the Kubernetes control plane logs for your cluster to CloudWatch Logs. By default, cluster control plane logs aren't exported to CloudWatch Logs. For more information, see [Amazon EKS Cluster Control Plane Logs](https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html) in the **Amazon EKS User Guide** .
│    │         > CloudWatch Logs ingestion, archive storage, and data scanning rates apply to exported control plane logs. For more information, see [CloudWatch Pricing](https://docs.aws.amazon.com/cloudwatch/pricing/) . 
│    │         In most cases, it takes several minutes to create a cluster. After you create an Amazon EKS cluster, you must configure your Kubernetes tooling to communicate with the API server and launch nodes into your cluster. For more information, see [Allowing users to access your cluster](https://docs.aws.amazon.com/eks/latest/userguide/cluster-auth.html) and [Launching Amazon EKS nodes](https://docs.aws.amazon.com/eks/latest/userguide/launch-workers.html) in the *Amazon EKS User Guide* .
│    └[~]  resource AWS::EKS::Nodegroup
│       ├      - documentation: Creates a managed node group for an Amazon EKS cluster.
│       │      You can only create a node group for your cluster that is equal to the current Kubernetes version for the cluster. All node groups are created with the latest AMI release version for the respective minor Kubernetes version of the cluster, unless you deploy a custom AMI using a launch template.
│       │      For later updates, you will only be able to update a node group using a launch template only if it was originally deployed with a launch template. Additionally, the launch template ID or name must match what was used when the node group was created. You can update the launch template version with necessary changes. For more information about using launch templates, see [Customizing managed nodes with launch templates](https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html) .
│       │      An Amazon EKS managed node group is an Amazon EC2 Auto Scaling group and associated Amazon EC2 instances that are managed by AWS for an Amazon EKS cluster. For more information, see [Managed node groups](https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html) in the *Amazon EKS User Guide* .
│       │      > Windows AMI types are only supported for commercial AWS Regions that support Windows on Amazon EKS.
│       │      + documentation: Creates a managed node group for an Amazon EKS cluster.
│       │      You can only create a node group for your cluster that is equal to the current Kubernetes version for the cluster. All node groups are created with the latest AMI release version for the respective minor Kubernetes version of the cluster, unless you deploy a custom AMI using a launch template.
│       │      For later updates, you will only be able to update a node group using a launch template only if it was originally deployed with a launch template. Additionally, the launch template ID or name must match what was used when the node group was created. You can update the launch template version with necessary changes. For more information about using launch templates, see [Customizing managed nodes with launch templates](https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html) .
│       │      An Amazon EKS managed node group is an Amazon EC2 Amazon EC2 Auto Scaling group and associated Amazon EC2 instances that are managed by AWS for an Amazon EKS cluster. For more information, see [Managed node groups](https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html) in the *Amazon EKS User Guide* .
│       │      > Windows AMI types are only supported for commercial AWS Regions that support Windows on Amazon EKS.
│       └ types
│          └[~] type ScalingConfig
│            └      - documentation: An object representing the scaling configuration details for the Auto Scaling group that is associated with your node group. When creating a node group, you must specify all or none of the properties. When updating a node group, you can specify any or none of the properties.
│                   + documentation: An object representing the scaling configuration details for the Amazon EC2 Auto Scaling group that is associated with your node group. When creating a node group, you must specify all or none of the properties. When updating a node group, you can specify any or none of the properties.
├[~] service aws-glue
│ └ resources
│    ├[~]  resource AWS::Glue::Integration
│    │  ├      - documentation: Resource Type definition for AWS::Glue::Integration
│    │  │      + documentation: The `AWS::Glue::Integration` resource specifies an AWS Glue zero-ETL integration from a data source to a target. For more information, see [zero-ETL integration supported by AWS Glue](https://docs.aws.amazon.com/glue/latest/dg/zero-etl-using.html) and [integration structure](https://docs.aws.amazon.com/glue/latest/dg/aws-glue-api-integrations.html) in the AWS Glue developer guide.
│    │  ├ properties
│    │  │  ├ AdditionalEncryptionContext: (documentation changed)
│    │  │  ├ DataFilter: (documentation changed)
│    │  │  ├ Description: (documentation changed)
│    │  │  ├ IntegrationConfig: (documentation changed)
│    │  │  ├ IntegrationName: (documentation changed)
│    │  │  ├ KmsKeyId: (documentation changed)
│    │  │  ├ SourceArn: (documentation changed)
│    │  │  ├ Tags: (documentation changed)
│    │  │  └ TargetArn: (documentation changed)
│    │  ├ attributes
│    │  │  ├ CreateTime: (documentation changed)
│    │  │  ├ IntegrationArn: (documentation changed)
│    │  │  └ Status: (documentation changed)
│    │  └ types
│    │     └[~] type IntegrationConfig
│    │       ├      - documentation: The configuration settings for the integration.
│    │       │      + documentation: Properties associated with the integration.
│    │       └ properties
│    │          ├ ContinuousSync: (documentation changed)
│    │          ├ RefreshInterval: (documentation changed)
│    │          └ SourceProperties: (documentation changed)
│    └[~]  resource AWS::Glue::IntegrationResourceProperty
│       ├      - documentation: Resource Type definition for AWS::Glue::IntegrationResourceProperty
│       │      + documentation: The `AWS::Glue::IntegrationResourceProperty` resource type can be used to setup `ResourceProperty` of the AWS Glue connection (for the SaaS source), DynamoDB Database (for DynamoDB source), or AWS Glue database ARN (for the target). ResourceProperty is used to define the properties requires to setup the integration, including the role to access the connection or database, KMS keys, event bus for event notifications and VPC connection. To set both source and target properties the same API needs to be invoked twice, once with the AWS Glue connection ARN as ResourceArn with SourceProcessingProperties and next, with the AWS Glue database ARN as ResourceArn with TargetProcessingProperties respectively.
│       ├ properties
│       │  └ TargetProcessingProperties: (documentation changed)
│       └ types
│          ├[~] type SourceProcessingProperties
│          │ ├      - documentation: The resource properties associated with the integration source.
│          │ │      + documentation: The structure used to define the resource properties associated with the integration source.
│          │ └ properties
│          │    └ RoleArn: (documentation changed)
│          └[~] type TargetProcessingProperties
│            ├      - documentation: The resource properties associated with the integration target.
│            │      + documentation: The structure used to define the resource properties associated with the integration target.
│            └ properties
│               ├ ConnectionName: (documentation changed)
│               └ RoleArn: (documentation changed)
├[~] service aws-lambda
│ └ resources
│    └[~]  resource AWS::Lambda::Function
│       ├ properties
│       │  └ TenancyConfig: (documentation changed)
│       └ types
│          └[~] type TenancyConfig
│            ├      - documentation: undefined
│            │      + documentation: Specifies the tenant isolation mode configuration for a Lambda function. This allows you to configure specific tenant isolation strategies for your function invocations. Tenant isolation configuration cannot be modified after function creation.
│            └ properties
│               └ TenantIsolationMode: (documentation changed)
├[~] service aws-mediaconnect
│ └ resources
│    ├[~]  resource AWS::MediaConnect::Flow
│    │  └ types
│    │     ├[~] type Encryption
│    │     │ └      - documentation: Information about the encryption of the flow.
│    │     │        + documentation: Encryption information.
│    │     └[~] type Source
│    │       └ properties
│    │          ├ RouterIntegrationState: (documentation changed)
│    │          └ RouterIntegrationTransitDecryption: (documentation changed)
│    ├[~]  resource AWS::MediaConnect::FlowEntitlement
│    │  ├ properties
│    │  │  └ Encryption: (documentation changed)
│    │  └ types
│    │     └[~] type Encryption
│    │       └      - documentation: Information about the encryption of the flow.
│    │              + documentation: Encryption information.
│    ├[~]  resource AWS::MediaConnect::FlowOutput
│    │  ├ properties
│    │  │  └ RouterIntegrationTransitEncryption: (documentation changed)
│    │  └ types
│    │     └[~] type Encryption
│    │       └      - documentation: Information about the encryption of the flow.
│    │              + documentation: Encryption information.
│    ├[~]  resource AWS::MediaConnect::FlowSource
│    │  └ types
│    │     └[~] type Encryption
│    │       └      - documentation: Information about the encryption of the flow.
│    │              + documentation: Encryption information.
│    ├[~]  resource AWS::MediaConnect::RouterInput
│    │  ├ properties
│    │  │  ├ AvailabilityZone: (documentation changed)
│    │  │  ├ MaintenanceConfiguration: (documentation changed)
│    │  │  ├ RegionName: (documentation changed)
│    │  │  ├ RoutingScope: (documentation changed)
│    │  │  ├ Tier: (documentation changed)
│    │  │  └ TransitEncryption: (documentation changed)
│    │  └ attributes
│    │     ├ Arn: (documentation changed)
│    │     ├ InputType: (documentation changed)
│    │     ├ MaintenanceType: (documentation changed)
│    │     └ State: (documentation changed)
│    ├[~]  resource AWS::MediaConnect::RouterNetworkInterface
│    │  ├ properties
│    │  │  └ RegionName: (documentation changed)
│    │  └ attributes
│    │     ├ Arn: (documentation changed)
│    │     ├ NetworkInterfaceType: (documentation changed)
│    │     └ State: (documentation changed)
│    └[~]  resource AWS::MediaConnect::RouterOutput
│       ├ properties
│       │  ├ AvailabilityZone: (documentation changed)
│       │  ├ MaintenanceConfiguration: (documentation changed)
│       │  ├ RegionName: (documentation changed)
│       │  ├ RoutingScope: (documentation changed)
│       │  ├ Tags: (documentation changed)
│       │  └ Tier: (documentation changed)
│       └ attributes
│          ├ Arn: (documentation changed)
│          ├ MaintenanceType: (documentation changed)
│          ├ OutputType: (documentation changed)
│          ├ RoutedState: (documentation changed)
│          └ State: (documentation changed)
├[~] service aws-opensearchservice
│ └ resources
│    └[~]  resource AWS::OpenSearchService::Domain
│       ├ properties
│       │  └ AIMLOptions: (documentation changed)
│       └ types
│          └[~] type S3VectorsEngine
│            ├      - documentation: undefined
│            │      + documentation: Options for enabling S3 vectors engine features on the specified domain.
│            └ properties
│               └ Enabled: (documentation changed)
├[~] service aws-organizations
│ └ resources
│    └[~]  resource AWS::Organizations::OrganizationalUnit
│       └      - documentation: Creates an organizational unit (OU) within a root or parent OU. An OU is a container for accounts that enables you to organize your accounts to apply policies according to your business requirements. The number of levels deep that you can nest OUs is dependent upon the policy types enabled for that root. For service control policies, the limit is five.
│              For more information about OUs, see [Managing organizational units (OUs)](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_ous.html) in the *AWS Organizations User Guide* .
│              If the request includes tags, then the requester must have the `organizations:TagResource` permission.
│              This operation can be called only from the organization's management account.
│              + documentation: Creates an organizational unit (OU) within a root or parent OU. An OU is a container for accounts that enables you to organize your accounts to apply policies according to your business requirements. The number of levels deep that you can nest OUs is dependent upon the policy types enabled for that root. For service control policies, the limit is five.
│              For more information about OUs, see [Managing organizational units (OUs)](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_ous.html) in the *AWS Organizations User Guide* .
│              If the request includes tags, then the requester must have the `organizations:TagResource` permission.
│              You can only call this operation from the management account.
└[~] service aws-vpclattice
  └ resources
     ├[~]  resource AWS::VpcLattice::DomainVerification
     │  ├      - documentation: Creates a Lattice Domain Verification
     │  │      + documentation: A domain name verification is an entity that allows you to prove your ownership of a given domain. When you create a domain verification using CloudFormation, use a waiter to make sure the domain verification is complete before you create a service network resource association, a VPC endpoint, or a service network VPC association with this domain.
     │  ├ properties
     │  │  ├ DomainName: (documentation changed)
     │  │  └ Tags: (documentation changed)
     │  ├ attributes
     │  │  ├ Arn: (documentation changed)
     │  │  ├ Id: (documentation changed)
     │  │  └ Status: (documentation changed)
     │  └ types
     │     └[~] type TxtMethodConfig
     │       ├      - documentation: undefined
     │       │      + documentation: Configuration for TXT record-based domain verification method.
     │       └ properties
     │          ├ name: (documentation changed)
     │          └ value: (documentation changed)
     ├[~]  resource AWS::VpcLattice::ResourceConfiguration
     │  └ properties
     │     ├ CustomDomainName: (documentation changed)
     │     ├ DomainVerificationId: (documentation changed)
     │     └ GroupDomain: (documentation changed)
     ├[~]  resource AWS::VpcLattice::ServiceNetworkResourceAssociation
     │  └ properties
     │     └ PrivateDnsEnabled: (documentation changed)
     └[~]  resource AWS::VpcLattice::ServiceNetworkVpcAssociation
        ├ properties
        │  ├ DnsOptions: (documentation changed)
        │  └ PrivateDnsEnabled: (documentation changed)
        └ types
           └[~] type DnsOptions
             ├      - documentation: undefined
             │      + documentation: The DNS configuration options.
             └ properties
                ├ PrivateDnsPreference: (documentation changed)
                └ PrivateDnsSpecifiedDomains: (documentation changed)