Revert "Update go-containerregistry to get https://github.com/google/go-containerregistry/pull/693"

This reverts commit f55c34ab92.

vendor/github.com/aws/aws-sdk-go/aws/arn/arn.go

@@ -1,93 +0,0 @@
-// Package arn provides a parser for interacting with Amazon Resource Names.
-package arn
-
-import (
-	"errors"
-	"strings"
-)
-
-const (
-	arnDelimiter = ":"
-	arnSections  = 6
-	arnPrefix    = "arn:"
-
-	// zero-indexed
-	sectionPartition = 1
-	sectionService   = 2
-	sectionRegion    = 3
-	sectionAccountID = 4
-	sectionResource  = 5
-
-	// errors
-	invalidPrefix   = "arn: invalid prefix"
-	invalidSections = "arn: not enough sections"
-)
-
-// ARN captures the individual fields of an Amazon Resource Name.
-// See http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html for more information.
-type ARN struct {
-	// The partition that the resource is in. For standard AWS regions, the partition is "aws". If you have resources in
-	// other partitions, the partition is "aws-partitionname". For example, the partition for resources in the China
-	// (Beijing) region is "aws-cn".
-	Partition string
-
-	// The service namespace that identifies the AWS product (for example, Amazon S3, IAM, or Amazon RDS). For a list of
-	// namespaces, see
-	// http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#genref-aws-service-namespaces.
-	Service string
-
-	// The region the resource resides in. Note that the ARNs for some resources do not require a region, so this
-	// component might be omitted.
-	Region string
-
-	// The ID of the AWS account that owns the resource, without the hyphens. For example, 123456789012. Note that the
-	// ARNs for some resources don't require an account number, so this component might be omitted.
-	AccountID string
-
-	// The content of this part of the ARN varies by service. It often includes an indicator of the type of resource —
-	// for example, an IAM user or Amazon RDS database - followed by a slash (/) or a colon (:), followed by the
-	// resource name itself. Some services allows paths for resource names, as described in
-	// http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arns-paths.
-	Resource string
-}
-
-// Parse parses an ARN into its constituent parts.
-//
-// Some example ARNs:
-// arn:aws:elasticbeanstalk:us-east-1:123456789012:environment/My App/MyEnvironment
-// arn:aws:iam::123456789012:user/David
-// arn:aws:rds:eu-west-1:123456789012:db:mysql-db
-// arn:aws:s3:::my_corporate_bucket/exampleobject.png
-func Parse(arn string) (ARN, error) {
-	if !strings.HasPrefix(arn, arnPrefix) {
-		return ARN{}, errors.New(invalidPrefix)
-	}
-	sections := strings.SplitN(arn, arnDelimiter, arnSections)
-	if len(sections) != arnSections {
-		return ARN{}, errors.New(invalidSections)
-	}
-	return ARN{
-		Partition: sections[sectionPartition],
-		Service:   sections[sectionService],
-		Region:    sections[sectionRegion],
-		AccountID: sections[sectionAccountID],
-		Resource:  sections[sectionResource],
-	}, nil
-}
-
-// IsARN returns whether the given string is an ARN by looking for
-// whether the string starts with "arn:" and contains the correct number
-// of sections delimited by colons(:).
-func IsARN(arn string) bool {
-	return strings.HasPrefix(arn, arnPrefix) && strings.Count(arn, ":") >= arnSections-1
-}
-
-// String returns the canonical representation of the ARN
-func (arn ARN) String() string {
-	return arnPrefix +
-		arn.Partition + arnDelimiter +
-		arn.Service + arnDelimiter +
-		arn.Region + arnDelimiter +
-		arn.AccountID + arnDelimiter +
-		arn.Resource
-}

vendor/github.com/aws/aws-sdk-go/aws/awsutil/path_value.go

@@ -70,7 +70,7 @@ func rValuesAtPath(v interface{}, path string, createPath, caseSensitive, nilTer
 			value = value.FieldByNameFunc(func(name string) bool {
 				if c == name {
 					return true
-				} else if !caseSensitive && strings.EqualFold(name, c) {
+				} else if !caseSensitive && strings.ToLower(name) == strings.ToLower(c) {
 					return true
 				}
 				return false

vendor/github.com/aws/aws-sdk-go/aws/client/client.go

@@ -12,7 +12,6 @@ import (
 type Config struct {
 	Config        *aws.Config
 	Handlers      request.Handlers
-	PartitionID   string
 	Endpoint      string
 	SigningRegion string
 	SigningName   string

vendor/github.com/aws/aws-sdk-go/aws/client/metadata/client_info.go

@@ -5,7 +5,6 @@ type ClientInfo struct {
 	ServiceName   string
 	ServiceID     string
 	APIVersion    string
-	PartitionID   string
 	Endpoint      string
 	SigningName   string
 	SigningRegion string

vendor/github.com/aws/aws-sdk-go/aws/config.go

@@ -161,10 +161,6 @@ type Config struct {
 	// on GetObject API calls.
 	S3DisableContentMD5Validation *bool
 
-	// Set this to `true` to have the S3 service client to use the region specified
-	// in the ARN, when an ARN is provided as an argument to a bucket parameter.
-	S3UseARNRegion *bool
-
 	// Set this to `true` to disable the EC2Metadata client from overriding the
 	// default http.Client's Timeout. This is helpful if you do not want the
 	// EC2Metadata client to create a new http.Client. This options is only
@@ -253,9 +249,6 @@ type Config struct {
 
 	// STSRegionalEndpoint will enable regional or legacy endpoint resolving
 	STSRegionalEndpoint endpoints.STSRegionalEndpoint
-
-	// S3UsEast1RegionalEndpoint will enable regional or legacy endpoint resolving
-	S3UsEast1RegionalEndpoint endpoints.S3UsEast1RegionalEndpoint
 }
 
 // NewConfig returns a new Config pointer that can be chained with builder
@@ -389,13 +382,6 @@ func (c *Config) WithS3DisableContentMD5Validation(enable bool) *Config {
 
 }
 
-// WithS3UseARNRegion sets a config S3UseARNRegion value and
-// returning a Config pointer for chaining
-func (c *Config) WithS3UseARNRegion(enable bool) *Config {
-	c.S3UseARNRegion = &enable
-	return c
-}
-
 // WithUseDualStack sets a config UseDualStack value returning a Config
 // pointer for chaining.
 func (c *Config) WithUseDualStack(enable bool) *Config {
@@ -444,13 +430,6 @@ func (c *Config) WithSTSRegionalEndpoint(sre endpoints.STSRegionalEndpoint) *Con
 	return c
 }
 
-// WithS3UsEast1RegionalEndpoint will set whether or not to use regional endpoint flag
-// when resolving the endpoint for a service
-func (c *Config) WithS3UsEast1RegionalEndpoint(sre endpoints.S3UsEast1RegionalEndpoint) *Config {
-	c.S3UsEast1RegionalEndpoint = sre
-	return c
-}
-
 func mergeInConfig(dst *Config, other *Config) {
 	if other == nil {
 		return
@@ -524,10 +503,6 @@ func mergeInConfig(dst *Config, other *Config) {
 		dst.S3DisableContentMD5Validation = other.S3DisableContentMD5Validation
 	}
 
-	if other.S3UseARNRegion != nil {
-		dst.S3UseARNRegion = other.S3UseARNRegion
-	}
-
 	if other.UseDualStack != nil {
 		dst.UseDualStack = other.UseDualStack
 	}
@@ -559,10 +534,6 @@ func mergeInConfig(dst *Config, other *Config) {
 	if other.STSRegionalEndpoint != endpoints.UnsetSTSEndpoint {
 		dst.STSRegionalEndpoint = other.STSRegionalEndpoint
 	}
-
-	if other.S3UsEast1RegionalEndpoint != endpoints.UnsetS3UsEast1Endpoint {
-		dst.S3UsEast1RegionalEndpoint = other.S3UsEast1RegionalEndpoint
-	}
 }
 
 // Copy will return a shallow copy of the Config object. If any additional

vendor/github.com/aws/aws-sdk-go/aws/corehandlers/handlers.go

@@ -161,7 +161,7 @@ func handleSendError(r *request.Request, err error) {
 	}
 	// Catch all request errors, and let the default retrier determine
 	// if the error is retryable.
-	r.Error = awserr.New(request.ErrCodeRequestError, "send request failed", err)
+	r.Error = awserr.New("RequestError", "send request failed", err)
 
 	// Override the error with a context canceled error, if that was canceled.
 	ctx := r.Context()

vendor/github.com/aws/aws-sdk-go/aws/credentials/processcreds/provider.go

@@ -90,7 +90,6 @@ import (
 
 	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/internal/sdkio"
 )
 
 const (
@@ -143,7 +142,7 @@ const (
 
 	// DefaultBufSize limits buffer size from growing to an enormous
 	// amount due to a faulty process.
-	DefaultBufSize = int(8 * sdkio.KibiByte)
+	DefaultBufSize = 1024
 
 	// DefaultTimeout default limit on time a process can run.
 	DefaultTimeout = time.Duration(1) * time.Minute

vendor/github.com/aws/aws-sdk-go/aws/credentials/stscreds/assume_role_provider.go

@@ -144,13 +144,6 @@ type AssumeRoleProvider struct {
 	// Session name, if you wish to reuse the credentials elsewhere.
 	RoleSessionName string
 
-	// Optional, you can pass tag key-value pairs to your session. These tags are called session tags.
-	Tags []*sts.Tag
-
-	// A list of keys for session tags that you want to set as transitive.
-	// If you set a tag key as transitive, the corresponding key and value passes to subsequent sessions in a role chain.
-	TransitiveTagKeys []*string
-
 	// Expiry duration of the STS credentials. Defaults to 15 minutes if not set.
 	Duration time.Duration
 
@@ -276,12 +269,10 @@ func (p *AssumeRoleProvider) Retrieve() (credentials.Value, error) {
 	}
 	jitter := time.Duration(sdkrand.SeededRand.Float64() * p.MaxJitterFrac * float64(p.Duration))
 	input := &sts.AssumeRoleInput{
-		DurationSeconds:   aws.Int64(int64((p.Duration - jitter) / time.Second)),
-		RoleArn:           aws.String(p.RoleARN),
-		RoleSessionName:   aws.String(p.RoleSessionName),
-		ExternalId:        p.ExternalID,
-		Tags:              p.Tags,
-		TransitiveTagKeys: p.TransitiveTagKeys,
+		DurationSeconds: aws.Int64(int64((p.Duration - jitter) / time.Second)),
+		RoleArn:         aws.String(p.RoleARN),
+		RoleSessionName: aws.String(p.RoleSessionName),
+		ExternalId:      p.ExternalID,
 	}
 	if p.Policy != nil {
 		input.Policy = p.Policy

vendor/github.com/aws/aws-sdk-go/aws/csm/reporter.go

@@ -89,7 +89,7 @@ func getMetricException(err awserr.Error) metricException {
 	code := err.Code()
 
 	switch code {
-	case request.ErrCodeRequestError,
+	case "RequestError",
 		request.ErrCodeSerialization,
 		request.CanceledErrorCode:
 		return sdkException{

vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/api.go

@@ -4,7 +4,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
-	"strconv"
 	"strings"
 	"time"
 
@@ -13,41 +12,8 @@ import (
 	"github.com/aws/aws-sdk-go/internal/sdkuri"
 )
 
-// getToken uses the duration to return a token for EC2 metadata service,
-// or an error if the request failed.
-func (c *EC2Metadata) getToken(duration time.Duration) (tokenOutput, error) {
-	op := &request.Operation{
-		Name:       "GetToken",
-		HTTPMethod: "PUT",
-		HTTPPath:   "/api/token",
-	}
-
-	var output tokenOutput
-	req := c.NewRequest(op, nil, &output)
-
-	// remove the fetch token handler from the request handlers to avoid infinite recursion
-	req.Handlers.Sign.RemoveByName(fetchTokenHandlerName)
-
-	// Swap the unmarshalMetadataHandler with unmarshalTokenHandler on this request.
-	req.Handlers.Unmarshal.Swap(unmarshalMetadataHandlerName, unmarshalTokenHandler)
-
-	ttl := strconv.FormatInt(int64(duration/time.Second), 10)
-	req.HTTPRequest.Header.Set(ttlHeader, ttl)
-
-	err := req.Send()
-
-	// Errors with bad request status should be returned.
-	if err != nil {
-		err = awserr.NewRequestFailure(
-			awserr.New(req.HTTPResponse.Status, http.StatusText(req.HTTPResponse.StatusCode), err),
-			req.HTTPResponse.StatusCode, req.RequestID)
-	}
-
-	return output, err
-}
-
 // GetMetadata uses the path provided to request information from the EC2
-// instance metadata service. The content will be returned as a string, or
+// instance metdata service. The content will be returned as a string, or
 // error if the request failed.
 func (c *EC2Metadata) GetMetadata(p string) (string, error) {
 	op := &request.Operation{
@@ -55,11 +21,11 @@ func (c *EC2Metadata) GetMetadata(p string) (string, error) {
 		HTTPMethod: "GET",
 		HTTPPath:   sdkuri.PathJoin("/meta-data", p),
 	}
+
 	output := &metadataOutput{}
-
 	req := c.NewRequest(op, nil, output)
-
 	err := req.Send()
+
 	return output.Content, err
 }
 
@@ -75,8 +41,13 @@ func (c *EC2Metadata) GetUserData() (string, error) {
 
 	output := &metadataOutput{}
 	req := c.NewRequest(op, nil, output)
-
+	req.Handlers.UnmarshalError.PushBack(func(r *request.Request) {
+		if r.HTTPResponse.StatusCode == http.StatusNotFound {
+			r.Error = awserr.New("NotFoundError", "user-data not found", r.Error)
+		}
+	})
 	err := req.Send()
+
 	return output.Content, err
 }
 
@@ -92,8 +63,8 @@ func (c *EC2Metadata) GetDynamicData(p string) (string, error) {
 
 	output := &metadataOutput{}
 	req := c.NewRequest(op, nil, output)
-
 	err := req.Send()
+
 	return output.Content, err
 }
 
@@ -145,17 +116,17 @@ func (c *EC2Metadata) IAMInfo() (EC2IAMInfo, error) {
 
 // Region returns the region the instance is running in.
 func (c *EC2Metadata) Region() (string, error) {
-	ec2InstanceIdentityDocument, err := c.GetInstanceIdentityDocument()
+	resp, err := c.GetMetadata("placement/availability-zone")
 	if err != nil {
 		return "", err
 	}
-	// extract region from the ec2InstanceIdentityDocument
-	region := ec2InstanceIdentityDocument.Region
-	if len(region) == 0 {
-		return "", awserr.New("EC2MetadataError", "invalid region received for ec2metadata instance", nil)
+
+	if len(resp) == 0 {
+		return "", awserr.New("EC2MetadataError", "invalid Region response", nil)
 	}
-	// returns region
-	return region, nil
+
+	// returns region without the suffix. Eg: us-west-2a becomes us-west-2
+	return resp[:len(resp)-1], nil
 }
 
 // Available returns if the application has access to the EC2 Metadata service.

vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/service.go

@@ -13,7 +13,6 @@ import (
 	"io"
 	"net/http"
 	"os"
-	"strconv"
 	"strings"
 	"time"
 
@@ -25,25 +24,9 @@ import (
 	"github.com/aws/aws-sdk-go/aws/request"
 )
 
-const (
-	// ServiceName is the name of the service.
-	ServiceName          = "ec2metadata"
-	disableServiceEnvVar = "AWS_EC2_METADATA_DISABLED"
-
-	// Headers for Token and TTL
-	ttlHeader   = "x-aws-ec2-metadata-token-ttl-seconds"
-	tokenHeader = "x-aws-ec2-metadata-token"
-
-	// Named Handler constants
-	fetchTokenHandlerName          = "FetchTokenHandler"
-	unmarshalMetadataHandlerName   = "unmarshalMetadataHandler"
-	unmarshalTokenHandlerName      = "unmarshalTokenHandler"
-	enableTokenProviderHandlerName = "enableTokenProviderHandler"
-
-	// TTL constants
-	defaultTTL = 21600 * time.Second
-	ttlExpirationWindow = 30 * time.Second
-)
+// ServiceName is the name of the service.
+const ServiceName = "ec2metadata"
+const disableServiceEnvVar = "AWS_EC2_METADATA_DISABLED"
 
 // A EC2Metadata is an EC2 Metadata service Client.
 type EC2Metadata struct {
@@ -97,27 +80,13 @@ func NewClient(cfg aws.Config, handlers request.Handlers, endpoint, signingRegio
 		),
 	}
 
-	// token provider instance
-	tp := newTokenProvider(svc, defaultTTL)
-
-	// NamedHandler for fetching token
-	svc.Handlers.Sign.PushBackNamed(request.NamedHandler{
-		Name: fetchTokenHandlerName,
-		Fn:   tp.fetchTokenHandler,
-	})
-	// NamedHandler for enabling token provider
-	svc.Handlers.Complete.PushBackNamed(request.NamedHandler{
-		Name: enableTokenProviderHandlerName,
-		Fn:   tp.enableTokenProviderHandler,
-	})
-
-	svc.Handlers.Unmarshal.PushBackNamed(unmarshalHandler)
+	svc.Handlers.Unmarshal.PushBack(unmarshalHandler)
 	svc.Handlers.UnmarshalError.PushBack(unmarshalError)
 	svc.Handlers.Validate.Clear()
 	svc.Handlers.Validate.PushBack(validateEndpointHandler)
 
 	// Disable the EC2 Metadata service if the environment variable is set.
-	// This short-circuits the service's functionality to always fail to send
+	// This shortcirctes the service's functionality to always fail to send
 	// requests.
 	if strings.ToLower(os.Getenv(disableServiceEnvVar)) == "true" {
 		svc.Handlers.Send.SwapNamed(request.NamedHandler{
@@ -138,6 +107,7 @@ func NewClient(cfg aws.Config, handlers request.Handlers, endpoint, signingRegio
 	for _, option := range opts {
 		option(svc.Client)
 	}
+
 	return svc
 }
 
@@ -149,74 +119,30 @@ type metadataOutput struct {
 	Content string
 }
 
-type tokenOutput struct {
-	Token string
-	TTL   time.Duration
-}
+func unmarshalHandler(r *request.Request) {
+	defer r.HTTPResponse.Body.Close()
+	b := &bytes.Buffer{}
+	if _, err := io.Copy(b, r.HTTPResponse.Body); err != nil {
+		r.Error = awserr.New(request.ErrCodeSerialization, "unable to unmarshal EC2 metadata response", err)
+		return
+	}
 
-// unmarshal token handler is used to parse the response of a getToken operation
-var unmarshalTokenHandler = request.NamedHandler{
-	Name: unmarshalTokenHandlerName,
-	Fn: func(r *request.Request) {
-		defer r.HTTPResponse.Body.Close()
-		var b bytes.Buffer
-		if _, err := io.Copy(&b, r.HTTPResponse.Body); err != nil {
-			r.Error = awserr.NewRequestFailure(awserr.New(request.ErrCodeSerialization,
-				"unable to unmarshal EC2 metadata response", err), r.HTTPResponse.StatusCode, r.RequestID)
-			return
-		}
-
-		v := r.HTTPResponse.Header.Get(ttlHeader)
-		data, ok := r.Data.(*tokenOutput)
-		if !ok {
-			return
-		}
-
-		data.Token = b.String()
-		// TTL is in seconds
-		i, err := strconv.ParseInt(v, 10, 64)
-		if err != nil {
-			r.Error = awserr.NewRequestFailure(awserr.New(request.ParamFormatErrCode,
-				"unable to parse EC2 token TTL response", err), r.HTTPResponse.StatusCode, r.RequestID)
-			return
-		}
-		t := time.Duration(i) * time.Second
-		data.TTL = t
-	},
-}
-
-var unmarshalHandler = request.NamedHandler{
-	Name: unmarshalMetadataHandlerName,
-	Fn: func(r *request.Request) {
-		defer r.HTTPResponse.Body.Close()
-		var b bytes.Buffer
-		if _, err := io.Copy(&b, r.HTTPResponse.Body); err != nil {
-			r.Error = awserr.NewRequestFailure(awserr.New(request.ErrCodeSerialization,
-				"unable to unmarshal EC2 metadata response", err), r.HTTPResponse.StatusCode, r.RequestID)
-			return
-		}
-
-		if data, ok := r.Data.(*metadataOutput); ok {
-			data.Content = b.String()
-		}
-	},
+	if data, ok := r.Data.(*metadataOutput); ok {
+		data.Content = b.String()
+	}
 }
 
 func unmarshalError(r *request.Request) {
 	defer r.HTTPResponse.Body.Close()
-	var b bytes.Buffer
-
-	if _, err := io.Copy(&b, r.HTTPResponse.Body); err != nil {
-		r.Error = awserr.NewRequestFailure(
-			awserr.New(request.ErrCodeSerialization, "unable to unmarshal EC2 metadata error response", err),
-			r.HTTPResponse.StatusCode, r.RequestID)
+	b := &bytes.Buffer{}
+	if _, err := io.Copy(b, r.HTTPResponse.Body); err != nil {
+		r.Error = awserr.New(request.ErrCodeSerialization, "unable to unmarshal EC2 metadata error response", err)
 		return
 	}
 
 	// Response body format is not consistent between metadata endpoints.
 	// Grab the error message as a string and include that as the source error
-	r.Error = awserr.NewRequestFailure(awserr.New("EC2MetadataError", "failed to make EC2Metadata request", errors.New(b.String())),
-		r.HTTPResponse.StatusCode, r.RequestID)
+	r.Error = awserr.New("EC2MetadataError", "failed to make EC2Metadata request", errors.New(b.String()))
 }
 
 func validateEndpointHandler(r *request.Request) {

vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/token_provider.go

@@ -1,92 +0,0 @@
-package ec2metadata
-
-import (
-	"net/http"
-	"sync/atomic"
-	"time"
-
-	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/request"
-)
-
-// A tokenProvider struct provides access to EC2Metadata client
-// and atomic instance of a token, along with configuredTTL for it.
-// tokenProvider also provides an atomic flag to disable the
-// fetch token operation.
-// The disabled member will use 0 as false, and 1 as true.
-type tokenProvider struct {
-	client        *EC2Metadata
-	token         atomic.Value
-	configuredTTL time.Duration
-	disabled      uint32
-}
-
-// A ec2Token struct helps use of token in EC2 Metadata service ops
-type ec2Token struct {
-	token string
-	credentials.Expiry
-}
-
-// newTokenProvider provides a pointer to a tokenProvider instance
-func newTokenProvider(c *EC2Metadata, duration time.Duration) *tokenProvider {
-	return &tokenProvider{client: c, configuredTTL: duration}
-}
-
-// fetchTokenHandler fetches token for EC2Metadata service client by default.
-func (t *tokenProvider) fetchTokenHandler(r *request.Request) {
-
-	// short-circuits to insecure data flow if tokenProvider is disabled.
-	if v := atomic.LoadUint32(&t.disabled); v == 1 {
-		return
-	}
-
-	if ec2Token, ok := t.token.Load().(ec2Token); ok && !ec2Token.IsExpired() {
-		r.HTTPRequest.Header.Set(tokenHeader, ec2Token.token)
-		return
-	}
-
-	output, err := t.client.getToken(t.configuredTTL)
-
-	if err != nil {
-
-		// change the disabled flag on token provider to true,
-		// when error is request timeout error.
-		if requestFailureError, ok := err.(awserr.RequestFailure); ok {
-			switch requestFailureError.StatusCode() {
-			case http.StatusForbidden, http.StatusNotFound, http.StatusMethodNotAllowed:
-				atomic.StoreUint32(&t.disabled, 1)
-			case http.StatusBadRequest:
-				r.Error = requestFailureError
-			}
-
-			// Check if request timed out while waiting for response
-			if e, ok := requestFailureError.OrigErr().(awserr.Error); ok {
-				if e.Code() == request.ErrCodeRequestError {
-					atomic.StoreUint32(&t.disabled, 1)
-				}
-			}
-		}
-		return
-	}
-
-	newToken := ec2Token{
-		token: output.Token,
-	}
-	newToken.SetExpiration(time.Now().Add(output.TTL), ttlExpirationWindow)
-	t.token.Store(newToken)
-
-	// Inject token header to the request.
-	if ec2Token, ok := t.token.Load().(ec2Token); ok {
-		r.HTTPRequest.Header.Set(tokenHeader, ec2Token.token)
-	}
-}
-
-// enableTokenProviderHandler enables the token provider
-func (t *tokenProvider) enableTokenProviderHandler(r *request.Request) {
-	// If the error code status is 401, we enable the token provider
-	if e, ok := r.Error.(awserr.RequestFailure); ok && e != nil &&
-		e.StatusCode() == http.StatusUnauthorized {
-		atomic.StoreUint32(&t.disabled, 0)
-	}
-}

vendor/github.com/aws/aws-sdk-go/aws/endpoints/decode.go

@@ -83,7 +83,6 @@ func decodeV3Endpoints(modelDef modelDefinition, opts DecodeModelOptions) (Resol
 		p := &ps[i]
 		custAddEC2Metadata(p)
 		custAddS3DualStack(p)
-		custRegionalS3(p)
 		custRmIotDataService(p)
 		custFixAppAutoscalingChina(p)
 		custFixAppAutoscalingUsGov(p)
@@ -101,33 +100,6 @@ func custAddS3DualStack(p *partition) {
 	custAddDualstack(p, "s3-control")
 }
 
-func custRegionalS3(p *partition) {
-	if p.ID != "aws" {
-		return
-	}
-
-	service, ok := p.Services["s3"]
-	if !ok {
-		return
-	}
-
-	// If global endpoint already exists no customization needed.
-	if _, ok := service.Endpoints["aws-global"]; ok {
-		return
-	}
-
-	service.PartitionEndpoint = "aws-global"
-	service.Endpoints["us-east-1"] = endpoint{}
-	service.Endpoints["aws-global"] = endpoint{
-		Hostname: "s3.amazonaws.com",
-		CredentialScope: credentialScope{
-			Region: "us-east-1",
-		},
-	}
-
-	p.Services["s3"] = service
-}
-
 func custAddDualstack(p *partition, svcName string) {
 	s, ok := p.Services[svcName]
 	if !ok {

vendor/github.com/aws/aws-sdk-go/aws/endpoints/endpoints.go

@@ -50,28 +50,12 @@ type Options struct {
 
 	// STS Regional Endpoint flag helps with resolving the STS endpoint
 	STSRegionalEndpoint STSRegionalEndpoint
-
-	// S3 Regional Endpoint flag helps with resolving the S3 endpoint
-	S3UsEast1RegionalEndpoint S3UsEast1RegionalEndpoint
 }
 
-// STSRegionalEndpoint is an enum for the states of the STS Regional Endpoint
-// options.
+// STSRegionalEndpoint is an enum type alias for int
+// It is used internally by the core sdk as STS Regional Endpoint flag value
 type STSRegionalEndpoint int
 
-func (e STSRegionalEndpoint) String() string {
-	switch e {
-	case LegacySTSEndpoint:
-		return "legacy"
-	case RegionalSTSEndpoint:
-		return "regional"
-	case UnsetSTSEndpoint:
-		return ""
-	default:
-		return "unknown"
-	}
-}
-
 const (
 
 	// UnsetSTSEndpoint represents that STS Regional Endpoint flag is not specified.
@@ -102,55 +86,6 @@ func GetSTSRegionalEndpoint(s string) (STSRegionalEndpoint, error) {
 	}
 }
 
-// S3UsEast1RegionalEndpoint is an enum for the states of the S3 us-east-1
-// Regional Endpoint options.
-type S3UsEast1RegionalEndpoint int
-
-func (e S3UsEast1RegionalEndpoint) String() string {
-	switch e {
-	case LegacyS3UsEast1Endpoint:
-		return "legacy"
-	case RegionalS3UsEast1Endpoint:
-		return "regional"
-	case UnsetS3UsEast1Endpoint:
-		return ""
-	default:
-		return "unknown"
-	}
-}
-
-const (
-
-	// UnsetS3UsEast1Endpoint represents that S3 Regional Endpoint flag is not
-	// specified.
-	UnsetS3UsEast1Endpoint S3UsEast1RegionalEndpoint = iota
-
-	// LegacyS3UsEast1Endpoint represents when S3 Regional Endpoint flag is
-	// specified to use legacy endpoints.
-	LegacyS3UsEast1Endpoint
-
-	// RegionalS3UsEast1Endpoint represents when S3 Regional Endpoint flag is
-	// specified to use regional endpoints.
-	RegionalS3UsEast1Endpoint
-)
-
-// GetS3UsEast1RegionalEndpoint function returns the S3UsEast1RegionalEndpointFlag based
-// on the input string provided in env config or shared config by the user.
-//
-// `legacy`, `regional` are the only case-insensitive valid strings for
-// resolving the S3 regional Endpoint flag.
-func GetS3UsEast1RegionalEndpoint(s string) (S3UsEast1RegionalEndpoint, error) {
-	switch {
-	case strings.EqualFold(s, "legacy"):
-		return LegacyS3UsEast1Endpoint, nil
-	case strings.EqualFold(s, "regional"):
-		return RegionalS3UsEast1Endpoint, nil
-	default:
-		return UnsetS3UsEast1Endpoint,
-			fmt.Errorf("unable to resolve the value of S3UsEast1RegionalEndpoint for %v", s)
-	}
-}
-
 // Set combines all of the option functions together.
 func (o *Options) Set(optFns ...func(*Options)) {
 	for _, fn := range optFns {
@@ -317,7 +252,7 @@ func (p Partition) EndpointFor(service, region string, opts ...func(*Options)) (
 // Regions returns a map of Regions indexed by their ID. This is useful for
 // enumerating over the regions in a partition.
 func (p Partition) Regions() map[string]Region {
-	rs := make(map[string]Region, len(p.p.Regions))
+	rs := map[string]Region{}
 	for id, r := range p.p.Regions {
 		rs[id] = Region{
 			id:   id,
@@ -332,7 +267,7 @@ func (p Partition) Regions() map[string]Region {
 // Services returns a map of Service indexed by their ID. This is useful for
 // enumerating over the services in a partition.
 func (p Partition) Services() map[string]Service {
-	ss := make(map[string]Service, len(p.p.Services))
+	ss := map[string]Service{}
 	for id := range p.p.Services {
 		ss[id] = Service{
 			id: id,
@@ -419,7 +354,7 @@ func (s Service) Regions() map[string]Region {
 // A region is the AWS region the service exists in. Whereas a Endpoint is
 // an URL that can be resolved to a instance of a service.
 func (s Service) Endpoints() map[string]Endpoint {
-	es := make(map[string]Endpoint, len(s.p.Services[s.id].Endpoints))
+	es := map[string]Endpoint{}
 	for id := range s.p.Services[s.id].Endpoints {
 		es[id] = Endpoint{
 			id:        id,
@@ -459,9 +394,6 @@ type ResolvedEndpoint struct {
 	// The endpoint URL
 	URL string
 
-	// The endpoint partition
-	PartitionID string
-
 	// The region that should be used for signing requests.
 	SigningRegion string
 

vendor/github.com/aws/aws-sdk-go/aws/endpoints/legacy_regions.go

@@ -1,24 +0,0 @@
-package endpoints
-
-var legacyGlobalRegions = map[string]map[string]struct{}{
-	"sts": {
-		"ap-northeast-1": {},
-		"ap-south-1":     {},
-		"ap-southeast-1": {},
-		"ap-southeast-2": {},
-		"ca-central-1":   {},
-		"eu-central-1":   {},
-		"eu-north-1":     {},
-		"eu-west-1":      {},
-		"eu-west-2":      {},
-		"eu-west-3":      {},
-		"sa-east-1":      {},
-		"us-east-1":      {},
-		"us-east-2":      {},
-		"us-west-1":      {},
-		"us-west-2":      {},
-	},
-	"s3": {
-		"us-east-1": {},
-	},
-}

vendor/github.com/aws/aws-sdk-go/aws/endpoints/sts_legacy_regions.go

@@ -0,0 +1,20 @@
+package endpoints
+
+var stsLegacyGlobalRegions = map[string]struct{}{
+	"ap-northeast-1": {},
+	"ap-south-1":     {},
+	"ap-southeast-1": {},
+	"ap-southeast-2": {},
+	"aws-global":     {},
+	"ca-central-1":   {},
+	"eu-central-1":   {},
+	"eu-north-1":     {},
+	"eu-west-1":      {},
+	"eu-west-2":      {},
+	"eu-west-3":      {},
+	"sa-east-1":      {},
+	"us-east-1":      {},
+	"us-east-2":      {},
+	"us-west-1":      {},
+	"us-west-2":      {},
+}

vendor/github.com/aws/aws-sdk-go/aws/endpoints/v3model.go

@@ -75,56 +75,31 @@ func (p partition) canResolveEndpoint(service, region string, strictMatch bool)
 	return p.RegionRegex.MatchString(region)
 }
 
-func allowLegacyEmptyRegion(service string) bool {
-	legacy := map[string]struct{}{
-		"budgets":       {},
-		"ce":            {},
-		"chime":         {},
-		"cloudfront":    {},
-		"ec2metadata":   {},
-		"iam":           {},
-		"importexport":  {},
-		"organizations": {},
-		"route53":       {},
-		"sts":           {},
-		"support":       {},
-		"waf":           {},
-	}
-
-	_, allowed := legacy[service]
-	return allowed
-}
-
 func (p partition) EndpointFor(service, region string, opts ...func(*Options)) (resolved ResolvedEndpoint, err error) {
 	var opt Options
 	opt.Set(opts...)
 
+	if service == "sts" && opt.STSRegionalEndpoint != RegionalSTSEndpoint {
+		if _, ok := stsLegacyGlobalRegions[region]; ok {
+			region = "aws-global"
+		}
+	}
+
 	s, hasService := p.Services[service]
-	if len(service) == 0 || !(hasService || opt.ResolveUnknownService) {
+	if !(hasService || opt.ResolveUnknownService) {
 		// Only return error if the resolver will not fallback to creating
 		// endpoint based on service endpoint ID passed in.
 		return resolved, NewUnknownServiceError(p.ID, service, serviceList(p.Services))
 	}
 
-	if len(region) == 0 && allowLegacyEmptyRegion(service) && len(s.PartitionEndpoint) != 0 {
-		region = s.PartitionEndpoint
-	}
-
-	if (service == "sts" && opt.STSRegionalEndpoint != RegionalSTSEndpoint) ||
-		(service == "s3" && opt.S3UsEast1RegionalEndpoint != RegionalS3UsEast1Endpoint) {
-		if _, ok := legacyGlobalRegions[service][region]; ok {
-			region = "aws-global"
-		}
-	}
-
 	e, hasEndpoint := s.endpointForRegion(region)
-	if len(region) == 0 || (!hasEndpoint && opt.StrictMatching) {
+	if !hasEndpoint && opt.StrictMatching {
 		return resolved, NewUnknownEndpointError(p.ID, service, region, endpointList(s.Endpoints))
 	}
 
 	defs := []endpoint{p.Defaults, s.Defaults}
 
-	return e.resolve(service, p.ID, region, p.DNSSuffix, defs, opt), nil
+	return e.resolve(service, region, p.DNSSuffix, defs, opt), nil
 }
 
 func serviceList(ss services) []string {
@@ -233,7 +208,7 @@ func getByPriority(s []string, p []string, def string) string {
 	return s[0]
 }
 
-func (e endpoint) resolve(service, partitionID, region, dnsSuffix string, defs []endpoint, opts Options) ResolvedEndpoint {
+func (e endpoint) resolve(service, region, dnsSuffix string, defs []endpoint, opts Options) ResolvedEndpoint {
 	var merged endpoint
 	for _, def := range defs {
 		merged.mergeIn(def)
@@ -241,6 +216,20 @@ func (e endpoint) resolve(service, partitionID, region, dnsSuffix string, defs [
 	merged.mergeIn(e)
 	e = merged
 
+	hostname := e.Hostname
+
+	// Offset the hostname for dualstack if enabled
+	if opts.UseDualStack && e.HasDualStack == boxedTrue {
+		hostname = e.DualStackHostname
+	}
+
+	u := strings.Replace(hostname, "{service}", service, 1)
+	u = strings.Replace(u, "{region}", region, 1)
+	u = strings.Replace(u, "{dnsSuffix}", dnsSuffix, 1)
+
+	scheme := getEndpointScheme(e.Protocols, opts.DisableSSL)
+	u = fmt.Sprintf("%s://%s", scheme, u)
+
 	signingRegion := e.CredentialScope.Region
 	if len(signingRegion) == 0 {
 		signingRegion = region
@@ -253,23 +242,8 @@ func (e endpoint) resolve(service, partitionID, region, dnsSuffix string, defs [
 		signingNameDerived = true
 	}
 
-	hostname := e.Hostname
-	// Offset the hostname for dualstack if enabled
-	if opts.UseDualStack && e.HasDualStack == boxedTrue {
-		hostname = e.DualStackHostname
-		region = signingRegion
-	}
-
-	u := strings.Replace(hostname, "{service}", service, 1)
-	u = strings.Replace(u, "{region}", region, 1)
-	u = strings.Replace(u, "{dnsSuffix}", dnsSuffix, 1)
-
-	scheme := getEndpointScheme(e.Protocols, opts.DisableSSL)
-	u = fmt.Sprintf("%s://%s", scheme, u)
-
 	return ResolvedEndpoint{
 		URL:                u,
-		PartitionID:        partitionID,
 		SigningRegion:      signingRegion,
 		SigningName:        signingName,
 		SigningNameDerived: signingNameDerived,

vendor/github.com/aws/aws-sdk-go/aws/request/handlers.go

@@ -10,7 +10,6 @@ import (
 type Handlers struct {
 	Validate         HandlerList
 	Build            HandlerList
-	BuildStream      HandlerList
 	Sign             HandlerList
 	Send             HandlerList
 	ValidateResponse HandlerList
@@ -29,7 +28,6 @@ func (h *Handlers) Copy() Handlers {
 	return Handlers{
 		Validate:         h.Validate.copy(),
 		Build:            h.Build.copy(),
-		BuildStream:      h.BuildStream.copy(),
 		Sign:             h.Sign.copy(),
 		Send:             h.Send.copy(),
 		ValidateResponse: h.ValidateResponse.copy(),
@@ -48,7 +46,6 @@ func (h *Handlers) Copy() Handlers {
 func (h *Handlers) Clear() {
 	h.Validate.Clear()
 	h.Build.Clear()
-	h.BuildStream.Clear()
 	h.Send.Clear()
 	h.Sign.Clear()
 	h.Unmarshal.Clear()
@@ -70,9 +67,6 @@ func (h *Handlers) IsEmpty() bool {
 	if h.Build.Len() != 0 {
 		return false
 	}
-	if h.BuildStream.Len() != 0 {
-		return false
-	}
 	if h.Send.Len() != 0 {
 		return false
 	}
@@ -326,18 +320,3 @@ func MakeAddToUserAgentFreeFormHandler(s string) func(*Request) {
 		AddToUserAgent(r, s)
 	}
 }
-
-// WithSetRequestHeaders updates the operation request's HTTP header to contain
-// the header key value pairs provided. If the header key already exists in the
-// request's HTTP header set, the existing value(s) will be replaced.
-func WithSetRequestHeaders(h map[string]string) Option {
-	return withRequestHeader(h).SetRequestHeaders
-}
-
-type withRequestHeader map[string]string
-
-func (h withRequestHeader) SetRequestHeaders(r *Request) {
-	for k, v := range h {
-		r.HTTPRequest.Header[k] = []string{v}
-	}
-}

vendor/github.com/aws/aws-sdk-go/aws/request/request.go

@@ -36,10 +36,6 @@ const (
 	// API request that was canceled. Requests given a aws.Context may
 	// return this error when canceled.
 	CanceledErrorCode = "RequestCanceled"
-
-	// ErrCodeRequestError is an error preventing the SDK from continuing to
-	// process the request.
-	ErrCodeRequestError = "RequestError"
 )
 
 // A Request is the service request to be made.
@@ -55,7 +51,6 @@ type Request struct {
 	HTTPRequest            *http.Request
 	HTTPResponse           *http.Response
 	Body                   io.ReadSeeker
-	streamingBody          io.ReadCloser
 	BodyStart              int64 // offset from beginning of Body that the request body starts
 	Params                 interface{}
 	Error                  error
@@ -104,12 +99,8 @@ type Operation struct {
 	BeforePresignFn func(r *Request) error
 }
 
-// New returns a new Request pointer for the service API operation and
-// parameters.
-//
-// A Retryer should be provided to direct how the request is retried. If
-// Retryer is nil, a default no retry value will be used. You can use
-// NoOpRetryer in the Client package to disable retry behavior directly.
+// New returns a new Request pointer for the service API
+// operation and parameters.
 //
 // Params is any value of input parameters to be the request payload.
 // Data is pointer value to an object which the request's response
@@ -117,10 +108,6 @@ type Operation struct {
 func New(cfg aws.Config, clientInfo metadata.ClientInfo, handlers Handlers,
 	retryer Retryer, operation *Operation, params interface{}, data interface{}) *Request {
 
-	if retryer == nil {
-		retryer = noOpRetryer{}
-	}
-
 	method := operation.HTTPMethod
 	if method == "" {
 		method = "POST"
@@ -300,13 +287,6 @@ func (r *Request) SetReaderBody(reader io.ReadSeeker) {
 	r.ResetBody()
 }
 
-// SetStreamingBody set the reader to be used for the request that will stream
-// bytes to the server. Request's Body must not be set to any reader.
-func (r *Request) SetStreamingBody(reader io.ReadCloser) {
-	r.streamingBody = reader
-	r.SetReaderBody(aws.ReadSeekCloser(reader))
-}
-
 // Presign returns the request's signed URL. Error will be returned
 // if the signing fails. The expire parameter is only used for presigned Amazon
 // S3 API requests. All other AWS services will use a fixed expiration
@@ -431,10 +411,6 @@ func (r *Request) Sign() error {
 }
 
 func (r *Request) getNextRequestBody() (body io.ReadCloser, err error) {
-	if r.streamingBody != nil {
-		return r.streamingBody, nil
-	}
-
 	if r.safeBody != nil {
 		r.safeBody.Close()
 	}

vendor/github.com/aws/aws-sdk-go/aws/request/request_pagination.go

@@ -17,13 +17,11 @@ import (
 // does the pagination between API operations, and Paginator defines the
 // configuration that will be used per page request.
 //
-//     for p.Next() {
+//     cont := true
+//     for p.Next() && cont {
 //         data := p.Page().(*s3.ListObjectsOutput)
 //         // process the page's data
-//         // ...
-//         // break out of loop to stop fetching additional pages
 //     }
-//
 //     return p.Err()
 //
 // See service client API operation Pages methods for examples how the SDK will

vendor/github.com/aws/aws-sdk-go/aws/request/retryer.go

@@ -35,47 +35,16 @@ type Retryer interface {
 }
 
 // WithRetryer sets a Retryer value to the given Config returning the Config
-// value for chaining. The value must not be nil.
+// value for chaining.
 func WithRetryer(cfg *aws.Config, retryer Retryer) *aws.Config {
-	if retryer == nil {
-		if cfg.Logger != nil {
-			cfg.Logger.Log("ERROR: Request.WithRetryer called with nil retryer. Replacing with retry disabled Retryer.")
-		}
-		retryer = noOpRetryer{}
-	}
 	cfg.Retryer = retryer
 	return cfg
-
-}
-
-// noOpRetryer is a internal no op retryer used when a request is created
-// without a retryer.
-//
-// Provides a retryer that performs no retries.
-// It should be used when we do not want retries to be performed.
-type noOpRetryer struct{}
-
-// MaxRetries returns the number of maximum returns the service will use to make
-// an individual API; For NoOpRetryer the MaxRetries will always be zero.
-func (d noOpRetryer) MaxRetries() int {
-	return 0
-}
-
-// ShouldRetry will always return false for NoOpRetryer, as it should never retry.
-func (d noOpRetryer) ShouldRetry(_ *Request) bool {
-	return false
-}
-
-// RetryRules returns the delay duration before retrying this request again;
-// since NoOpRetryer does not retry, RetryRules always returns 0.
-func (d noOpRetryer) RetryRules(_ *Request) time.Duration {
-	return 0
 }
 
 // retryableCodes is a collection of service response codes which are retry-able
 // without any further action.
 var retryableCodes = map[string]struct{}{
-	ErrCodeRequestError:       {},
+	"RequestError":            {},
 	"RequestTimeout":          {},
 	ErrCodeResponseTimeout:    {},
 	"RequestTimeoutException": {}, // Glacier's flavor of RequestTimeout
@@ -83,7 +52,6 @@ var retryableCodes = map[string]struct{}{
 
 var throttleCodes = map[string]struct{}{
 	"ProvisionedThroughputExceededException": {},
-	"ThrottledException":                     {}, // SNS, XRay, ResourceGroupsTagging API
 	"Throttling":                             {},
 	"ThrottlingException":                    {},
 	"RequestLimitExceeded":                   {},
@@ -177,8 +145,8 @@ func shouldRetryError(origErr error) bool {
 		origErr := err.OrigErr()
 		var shouldRetry bool
 		if origErr != nil {
-			shouldRetry = shouldRetryError(origErr)
-			if err.Code() == ErrCodeRequestError && !shouldRetry {
+			shouldRetry := shouldRetryError(origErr)
+			if err.Code() == "RequestError" && !shouldRetry {
 				return false
 			}
 		}

vendor/github.com/aws/aws-sdk-go/aws/session/credentials.go

@@ -47,10 +47,10 @@ func resolveCredentials(cfg *aws.Config,
 }
 
 // WebIdentityEmptyRoleARNErr will occur if 'AWS_WEB_IDENTITY_TOKEN_FILE' was set but
-// 'AWS_ROLE_ARN' was not set.
+// 'AWS_IAM_ROLE_ARN' was not set.
 var WebIdentityEmptyRoleARNErr = awserr.New(stscreds.ErrCodeWebIdentity, "role ARN is not set", nil)
 
-// WebIdentityEmptyTokenFilePathErr will occur if 'AWS_ROLE_ARN' was set but
+// WebIdentityEmptyTokenFilePathErr will occur if 'AWS_IAM_ROLE_ARN' was set but
 // 'AWS_WEB_IDENTITY_TOKEN_FILE' was not set.
 var WebIdentityEmptyTokenFilePathErr = awserr.New(stscreds.ErrCodeWebIdentity, "token file path is not set", nil)
 

vendor/github.com/aws/aws-sdk-go/aws/session/env_config.go

@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"os"
 	"strconv"
-	"strings"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/credentials"
@@ -129,25 +128,11 @@ type envConfig struct {
 	//  AWS_ROLE_SESSION_NAME=session_name
 	RoleSessionName string
 
-	// Specifies the STS Regional Endpoint flag for the SDK to resolve the endpoint
-	// for a service.
+	// Specifies the Regional Endpoint flag for the sdk to resolve the endpoint for a service
 	//
-	// AWS_STS_REGIONAL_ENDPOINTS=regional
+	// AWS_STS_REGIONAL_ENDPOINTS =sts_regional_endpoint
 	// This can take value as `regional` or `legacy`
 	STSRegionalEndpoint endpoints.STSRegionalEndpoint
-
-	// Specifies the S3 Regional Endpoint flag for the SDK to resolve the
-	// endpoint for a service.
-	//
-	// AWS_S3_US_EAST_1_REGIONAL_ENDPOINT=regional
-	// This can take value as `regional` or `legacy`
-	S3UsEast1RegionalEndpoint endpoints.S3UsEast1RegionalEndpoint
-
-	// Specifies if the S3 service should allow ARNs to direct the region
-	// the client's requests are sent to.
-	//
-	// AWS_S3_USE_ARN_REGION=true
-	S3UseARNRegion bool
 }
 
 var (
@@ -205,12 +190,6 @@ var (
 	stsRegionalEndpointKey = []string{
 		"AWS_STS_REGIONAL_ENDPOINTS",
 	}
-	s3UsEast1RegionalEndpoint = []string{
-		"AWS_S3_US_EAST_1_REGIONAL_ENDPOINT",
-	}
-	s3UseARNRegionEnvKey = []string{
-		"AWS_S3_USE_ARN_REGION",
-	}
 )
 
 // loadEnvConfig retrieves the SDK's environment configuration.
@@ -296,39 +275,14 @@ func envConfigLoad(enableSharedConfig bool) (envConfig, error) {
 
 	cfg.CustomCABundle = os.Getenv("AWS_CA_BUNDLE")
 
-	var err error
 	// STS Regional Endpoint variable
 	for _, k := range stsRegionalEndpointKey {
 		if v := os.Getenv(k); len(v) != 0 {
-			cfg.STSRegionalEndpoint, err = endpoints.GetSTSRegionalEndpoint(v)
+			STSRegionalEndpoint, err := endpoints.GetSTSRegionalEndpoint(v)
 			if err != nil {
 				return cfg, fmt.Errorf("failed to load, %v from env config, %v", k, err)
 			}
-		}
-	}
-
-	// S3 Regional Endpoint variable
-	for _, k := range s3UsEast1RegionalEndpoint {
-		if v := os.Getenv(k); len(v) != 0 {
-			cfg.S3UsEast1RegionalEndpoint, err = endpoints.GetS3UsEast1RegionalEndpoint(v)
-			if err != nil {
-				return cfg, fmt.Errorf("failed to load, %v from env config, %v", k, err)
-			}
-		}
-	}
-
-	var s3UseARNRegion string
-	setFromEnvVal(&s3UseARNRegion, s3UseARNRegionEnvKey)
-	if len(s3UseARNRegion) != 0 {
-		switch {
-		case strings.EqualFold(s3UseARNRegion, "false"):
-			cfg.S3UseARNRegion = false
-		case strings.EqualFold(s3UseARNRegion, "true"):
-			cfg.S3UseARNRegion = true
-		default:
-			return envConfig{}, fmt.Errorf(
-				"invalid value for environment variable, %s=%s, need true or false",
-				s3UseARNRegionEnvKey[0], s3UseARNRegion)
+			cfg.STSRegionalEndpoint = STSRegionalEndpoint
 		}
 	}
 

vendor/github.com/aws/aws-sdk-go/aws/session/session.go

@@ -555,20 +555,7 @@ func mergeConfigSrcs(cfg, userCfg *aws.Config,
 	}
 
 	// Regional Endpoint flag for STS endpoint resolving
-	mergeSTSRegionalEndpointConfig(cfg, []endpoints.STSRegionalEndpoint{
-		userCfg.STSRegionalEndpoint,
-		envCfg.STSRegionalEndpoint,
-		sharedCfg.STSRegionalEndpoint,
-		endpoints.LegacySTSEndpoint,
-	})
-
-	// Regional Endpoint flag for S3 endpoint resolving
-	mergeS3UsEast1RegionalEndpointConfig(cfg, []endpoints.S3UsEast1RegionalEndpoint{
-		userCfg.S3UsEast1RegionalEndpoint,
-		envCfg.S3UsEast1RegionalEndpoint,
-		sharedCfg.S3UsEast1RegionalEndpoint,
-		endpoints.LegacyS3UsEast1Endpoint,
-	})
+	mergeSTSRegionalEndpointConfig(cfg, envCfg, sharedCfg)
 
 	// Configure credentials if not already set by the user when creating the
 	// Session.
@@ -580,33 +567,23 @@ func mergeConfigSrcs(cfg, userCfg *aws.Config,
 		cfg.Credentials = creds
 	}
 
-	cfg.S3UseARNRegion = userCfg.S3UseARNRegion
-	if cfg.S3UseARNRegion == nil {
-		cfg.S3UseARNRegion = &envCfg.S3UseARNRegion
-	}
-	if cfg.S3UseARNRegion == nil {
-		cfg.S3UseARNRegion = &sharedCfg.S3UseARNRegion
-	}
-
 	return nil
 }
 
-func mergeSTSRegionalEndpointConfig(cfg *aws.Config, values []endpoints.STSRegionalEndpoint) {
-	for _, v := range values {
-		if v != endpoints.UnsetSTSEndpoint {
-			cfg.STSRegionalEndpoint = v
-			break
-		}
-	}
-}
+// mergeSTSRegionalEndpointConfig function merges the STSRegionalEndpoint into cfg from
+// envConfig and SharedConfig with envConfig being given precedence over SharedConfig
+func mergeSTSRegionalEndpointConfig(cfg *aws.Config, envCfg envConfig, sharedCfg sharedConfig) error {
 
-func mergeS3UsEast1RegionalEndpointConfig(cfg *aws.Config, values []endpoints.S3UsEast1RegionalEndpoint) {
-	for _, v := range values {
-		if v != endpoints.UnsetS3UsEast1Endpoint {
-			cfg.S3UsEast1RegionalEndpoint = v
-			break
-		}
+	cfg.STSRegionalEndpoint = envCfg.STSRegionalEndpoint
+
+	if cfg.STSRegionalEndpoint == endpoints.UnsetSTSEndpoint {
+		cfg.STSRegionalEndpoint = sharedCfg.STSRegionalEndpoint
 	}
+
+	if cfg.STSRegionalEndpoint == endpoints.UnsetSTSEndpoint {
+		cfg.STSRegionalEndpoint = endpoints.LegacySTSEndpoint
+	}
+	return nil
 }
 
 func initHandlers(s *Session) {
@@ -637,67 +614,50 @@ func (s *Session) Copy(cfgs ...*aws.Config) *Session {
 // ClientConfig satisfies the client.ConfigProvider interface and is used to
 // configure the service client instances. Passing the Session to the service
 // client's constructor (New) will use this method to configure the client.
-func (s *Session) ClientConfig(service string, cfgs ...*aws.Config) client.Config {
+func (s *Session) ClientConfig(serviceName string, cfgs ...*aws.Config) client.Config {
+	// Backwards compatibility, the error will be eaten if user calls ClientConfig
+	// directly. All SDK services will use ClientconfigWithError.
+	cfg, _ := s.clientConfigWithErr(serviceName, cfgs...)
+
+	return cfg
+}
+
+func (s *Session) clientConfigWithErr(serviceName string, cfgs ...*aws.Config) (client.Config, error) {
 	s = s.Copy(cfgs...)
 
+	var resolved endpoints.ResolvedEndpoint
+	var err error
+
 	region := aws.StringValue(s.Config.Region)
-	resolved, err := s.resolveEndpoint(service, region, s.Config)
-	if err != nil {
-		s.Handlers.Validate.PushBack(func(r *request.Request) {
-			if len(r.ClientInfo.Endpoint) != 0 {
-				// Error occurred while resolving endpoint, but the request
-				// being invoked has had an endpoint specified after the client
-				// was created.
-				return
-			}
-			r.Error = err
-		})
+
+	if endpoint := aws.StringValue(s.Config.Endpoint); len(endpoint) != 0 {
+		resolved.URL = endpoints.AddScheme(endpoint, aws.BoolValue(s.Config.DisableSSL))
+		resolved.SigningRegion = region
+	} else {
+		resolved, err = s.Config.EndpointResolver.EndpointFor(
+			serviceName, region,
+			func(opt *endpoints.Options) {
+				opt.DisableSSL = aws.BoolValue(s.Config.DisableSSL)
+				opt.UseDualStack = aws.BoolValue(s.Config.UseDualStack)
+				// Support for STSRegionalEndpoint where the STSRegionalEndpoint is
+				// provided in envconfig or sharedconfig with envconfig getting precedence.
+				opt.STSRegionalEndpoint = s.Config.STSRegionalEndpoint
+
+				// Support the condition where the service is modeled but its
+				// endpoint metadata is not available.
+				opt.ResolveUnknownService = true
+			},
+		)
 	}
 
 	return client.Config{
 		Config:             s.Config,
 		Handlers:           s.Handlers,
-		PartitionID:        resolved.PartitionID,
 		Endpoint:           resolved.URL,
 		SigningRegion:      resolved.SigningRegion,
 		SigningNameDerived: resolved.SigningNameDerived,
 		SigningName:        resolved.SigningName,
-	}
-}
-
-func (s *Session) resolveEndpoint(service, region string, cfg *aws.Config) (endpoints.ResolvedEndpoint, error) {
-
-	if ep := aws.StringValue(cfg.Endpoint); len(ep) != 0 {
-		return endpoints.ResolvedEndpoint{
-			URL:           endpoints.AddScheme(ep, aws.BoolValue(cfg.DisableSSL)),
-			SigningRegion: region,
-		}, nil
-	}
-
-	resolved, err := cfg.EndpointResolver.EndpointFor(service, region,
-		func(opt *endpoints.Options) {
-			opt.DisableSSL = aws.BoolValue(cfg.DisableSSL)
-			opt.UseDualStack = aws.BoolValue(cfg.UseDualStack)
-			// Support for STSRegionalEndpoint where the STSRegionalEndpoint is
-			// provided in envConfig or sharedConfig with envConfig getting
-			// precedence.
-			opt.STSRegionalEndpoint = cfg.STSRegionalEndpoint
-
-			// Support for S3UsEast1RegionalEndpoint where the S3UsEast1RegionalEndpoint is
-			// provided in envConfig or sharedConfig with envConfig getting
-			// precedence.
-			opt.S3UsEast1RegionalEndpoint = cfg.S3UsEast1RegionalEndpoint
-
-			// Support the condition where the service is modeled but its
-			// endpoint metadata is not available.
-			opt.ResolveUnknownService = true
-		},
-	)
-	if err != nil {
-		return endpoints.ResolvedEndpoint{}, err
-	}
-
-	return resolved, nil
+	}, err
 }
 
 // ClientConfigNoResolveEndpoint is the same as ClientConfig with the exception
@@ -707,9 +667,12 @@ func (s *Session) ClientConfigNoResolveEndpoint(cfgs ...*aws.Config) client.Conf
 	s = s.Copy(cfgs...)
 
 	var resolved endpoints.ResolvedEndpoint
+
+	region := aws.StringValue(s.Config.Region)
+
 	if ep := aws.StringValue(s.Config.Endpoint); len(ep) > 0 {
 		resolved.URL = endpoints.AddScheme(ep, aws.BoolValue(s.Config.DisableSSL))
-		resolved.SigningRegion = aws.StringValue(s.Config.Region)
+		resolved.SigningRegion = region
 	}
 
 	return client.Config{

vendor/github.com/aws/aws-sdk-go/aws/session/shared_config.go

@@ -44,16 +44,10 @@ const (
 	// Additional config fields for regional or legacy endpoints
 	stsRegionalEndpointSharedKey = `sts_regional_endpoints`
 
-	// Additional config fields for regional or legacy endpoints
-	s3UsEast1RegionalSharedKey = `s3_us_east_1_regional_endpoint`
-
 	// DefaultSharedConfigProfile is the default profile to be used when
 	// loading configuration from the config files if another profile name
 	// is not provided.
 	DefaultSharedConfigProfile = `default`
-
-	// S3 ARN Region Usage
-	s3UseARNRegionKey = "s3_use_arn_region"
 )
 
 // sharedConfig represents the configuration fields of the SDK config files.
@@ -92,30 +86,17 @@ type sharedConfig struct {
 	//
 	//	endpoint_discovery_enabled = true
 	EnableEndpointDiscovery *bool
-
 	// CSM Options
 	CSMEnabled  *bool
 	CSMHost     string
 	CSMPort     string
 	CSMClientID string
 
-	// Specifies the Regional Endpoint flag for the SDK to resolve the endpoint for a service
+	// Specifies the Regional Endpoint flag for the sdk to resolve the endpoint for a service
 	//
-	// sts_regional_endpoints = regional
+	// sts_regional_endpoints = sts_regional_endpoint
 	// This can take value as `LegacySTSEndpoint` or `RegionalSTSEndpoint`
 	STSRegionalEndpoint endpoints.STSRegionalEndpoint
-
-	// Specifies the Regional Endpoint flag for the SDK to resolve the endpoint for a service
-	//
-	// s3_us_east_1_regional_endpoint = regional
-	// This can take value as `LegacyS3UsEast1Endpoint` or `RegionalS3UsEast1Endpoint`
-	S3UsEast1RegionalEndpoint endpoints.S3UsEast1RegionalEndpoint
-
-	// Specifies if the S3 service should allow ARNs to direct the region
-	// the client's requests are sent to.
-	//
-	// s3_use_arn_region=true
-	S3UseARNRegion bool
 }
 
 type sharedConfigFile struct {
@@ -278,19 +259,10 @@ func (cfg *sharedConfig) setFromIniFile(profile string, file sharedConfigFile, e
 			sre, err := endpoints.GetSTSRegionalEndpoint(v)
 			if err != nil {
 				return fmt.Errorf("failed to load %s from shared config, %s, %v",
-					stsRegionalEndpointSharedKey, file.Filename, err)
+					stsRegionalEndpointKey, file.Filename, err)
 			}
 			cfg.STSRegionalEndpoint = sre
 		}
-
-		if v := section.String(s3UsEast1RegionalSharedKey); len(v) != 0 {
-			sre, err := endpoints.GetS3UsEast1RegionalEndpoint(v)
-			if err != nil {
-				return fmt.Errorf("failed to load %s from shared config, %s, %v",
-					s3UsEast1RegionalSharedKey, file.Filename, err)
-			}
-			cfg.S3UsEast1RegionalEndpoint = sre
-		}
 	}
 
 	updateString(&cfg.CredentialProcess, section, credentialProcessKey)
@@ -316,8 +288,6 @@ func (cfg *sharedConfig) setFromIniFile(profile string, file sharedConfigFile, e
 	updateString(&cfg.CSMPort, section, csmPortKey)
 	updateString(&cfg.CSMClientID, section, csmClientIDKey)
 
-	updateBool(&cfg.S3UseARNRegion, section, s3UseARNRegionKey)
-
 	return nil
 }
 
@@ -410,15 +380,6 @@ func updateString(dst *string, section ini.Section, key string) {
 	*dst = section.String(key)
 }
 
-// updateBool will only update the dst with the value in the section key, key
-// is present in the section.
-func updateBool(dst *bool, section ini.Section, key string) {
-	if !section.Has(key) {
-		return
-	}
-	*dst = section.Bool(key)
-}
-
 // updateBoolPtr will only update the dst with the value in the section key,
 // key is present in the section.
 func updateBoolPtr(dst **bool, section ini.Section, key string) {

vendor/github.com/aws/aws-sdk-go/aws/signer/v4/stream.go

@@ -1,63 +0,0 @@
-package v4
-
-import (
-	"encoding/hex"
-	"strings"
-	"time"
-
-	"github.com/aws/aws-sdk-go/aws/credentials"
-)
-
-type credentialValueProvider interface {
-	Get() (credentials.Value, error)
-}
-
-// StreamSigner implements signing of event stream encoded payloads
-type StreamSigner struct {
-	region  string
-	service string
-
-	credentials credentialValueProvider
-
-	prevSig []byte
-}
-
-// NewStreamSigner creates a SigV4 signer used to sign Event Stream encoded messages
-func NewStreamSigner(region, service string, seedSignature []byte, credentials *credentials.Credentials) *StreamSigner {
-	return &StreamSigner{
-		region:      region,
-		service:     service,
-		credentials: credentials,
-		prevSig:     seedSignature,
-	}
-}
-
-// GetSignature takes an event stream encoded headers and payload and returns a signature
-func (s *StreamSigner) GetSignature(headers, payload []byte, date time.Time) ([]byte, error) {
-	credValue, err := s.credentials.Get()
-	if err != nil {
-		return nil, err
-	}
-
-	sigKey := deriveSigningKey(s.region, s.service, credValue.SecretAccessKey, date)
-
-	keyPath := buildSigningScope(s.region, s.service, date)
-
-	stringToSign := buildEventStreamStringToSign(headers, payload, s.prevSig, keyPath, date)
-
-	signature := hmacSHA256(sigKey, []byte(stringToSign))
-	s.prevSig = signature
-
-	return signature, nil
-}
-
-func buildEventStreamStringToSign(headers, payload, prevSig []byte, scope string, date time.Time) string {
-	return strings.Join([]string{
-		"AWS4-HMAC-SHA256-PAYLOAD",
-		formatTime(date),
-		scope,
-		hex.EncodeToString(prevSig),
-		hex.EncodeToString(hashSHA256(headers)),
-		hex.EncodeToString(hashSHA256(payload)),
-	}, "\n")
-}

vendor/github.com/aws/aws-sdk-go/aws/signer/v4/v4.go

@@ -76,14 +76,9 @@ import (
 )
 
 const (
-	authorizationHeader     = "Authorization"
-	authHeaderSignatureElem = "Signature="
-	signatureQueryKey       = "X-Amz-Signature"
-
 	authHeaderPrefix = "AWS4-HMAC-SHA256"
 	timeFormat       = "20060102T150405Z"
 	shortTimeFormat  = "20060102"
-	awsV4Request     = "aws4_request"
 
 	// emptyStringSHA256 is a SHA256 of an empty string
 	emptyStringSHA256 = `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
@@ -92,9 +87,9 @@ const (
 var ignoredHeaders = rules{
 	blacklist{
 		mapRule{
-			authorizationHeader: struct{}{},
-			"User-Agent":        struct{}{},
-			"X-Amzn-Trace-Id":   struct{}{},
+			"Authorization":   struct{}{},
+			"User-Agent":      struct{}{},
+			"X-Amzn-Trace-Id": struct{}{},
 		},
 	},
 }
@@ -234,9 +229,11 @@ type signingCtx struct {
 
 	DisableURIPathEscaping bool
 
-	credValues      credentials.Value
-	isPresign       bool
-	unsignedPayload bool
+	credValues         credentials.Value
+	isPresign          bool
+	formattedTime      string
+	formattedShortTime string
+	unsignedPayload    bool
 
 	bodyDigest       string
 	signedHeaders    string
@@ -535,56 +532,39 @@ func (ctx *signingCtx) build(disableHeaderHoisting bool) error {
 	ctx.buildSignature()       // depends on string to sign
 
 	if ctx.isPresign {
-		ctx.Request.URL.RawQuery += "&" + signatureQueryKey + "=" + ctx.signature
+		ctx.Request.URL.RawQuery += "&X-Amz-Signature=" + ctx.signature
 	} else {
 		parts := []string{
 			authHeaderPrefix + " Credential=" + ctx.credValues.AccessKeyID + "/" + ctx.credentialString,
 			"SignedHeaders=" + ctx.signedHeaders,
-			authHeaderSignatureElem + ctx.signature,
+			"Signature=" + ctx.signature,
 		}
-		ctx.Request.Header.Set(authorizationHeader, strings.Join(parts, ", "))
+		ctx.Request.Header.Set("Authorization", strings.Join(parts, ", "))
 	}
 
 	return nil
 }
 
-// GetSignedRequestSignature attempts to extract the signature of the request.
-// Returning an error if the request is unsigned, or unable to extract the
-// signature.
-func GetSignedRequestSignature(r *http.Request) ([]byte, error) {
-
-	if auth := r.Header.Get(authorizationHeader); len(auth) != 0 {
-		ps := strings.Split(auth, ", ")
-		for _, p := range ps {
-			if idx := strings.Index(p, authHeaderSignatureElem); idx >= 0 {
-				sig := p[len(authHeaderSignatureElem):]
-				if len(sig) == 0 {
-					return nil, fmt.Errorf("invalid request signature authorization header")
-				}
-				return hex.DecodeString(sig)
-			}
-		}
-	}
-
-	if sig := r.URL.Query().Get("X-Amz-Signature"); len(sig) != 0 {
-		return hex.DecodeString(sig)
-	}
-
-	return nil, fmt.Errorf("request not signed")
-}
-
 func (ctx *signingCtx) buildTime() {
+	ctx.formattedTime = ctx.Time.UTC().Format(timeFormat)
+	ctx.formattedShortTime = ctx.Time.UTC().Format(shortTimeFormat)
+
 	if ctx.isPresign {
 		duration := int64(ctx.ExpireTime / time.Second)
-		ctx.Query.Set("X-Amz-Date", formatTime(ctx.Time))
+		ctx.Query.Set("X-Amz-Date", ctx.formattedTime)
 		ctx.Query.Set("X-Amz-Expires", strconv.FormatInt(duration, 10))
 	} else {
-		ctx.Request.Header.Set("X-Amz-Date", formatTime(ctx.Time))
+		ctx.Request.Header.Set("X-Amz-Date", ctx.formattedTime)
 	}
 }
 
 func (ctx *signingCtx) buildCredentialString() {
-	ctx.credentialString = buildSigningScope(ctx.Region, ctx.ServiceName, ctx.Time)
+	ctx.credentialString = strings.Join([]string{
+		ctx.formattedShortTime,
+		ctx.Region,
+		ctx.ServiceName,
+		"aws4_request",
+	}, "/")
 
 	if ctx.isPresign {
 		ctx.Query.Set("X-Amz-Credential", ctx.credValues.AccessKeyID+"/"+ctx.credentialString)
@@ -673,15 +653,19 @@ func (ctx *signingCtx) buildCanonicalString() {
 func (ctx *signingCtx) buildStringToSign() {
 	ctx.stringToSign = strings.Join([]string{
 		authHeaderPrefix,
-		formatTime(ctx.Time),
+		ctx.formattedTime,
 		ctx.credentialString,
-		hex.EncodeToString(hashSHA256([]byte(ctx.canonicalString))),
+		hex.EncodeToString(makeSha256([]byte(ctx.canonicalString))),
 	}, "\n")
 }
 
 func (ctx *signingCtx) buildSignature() {
-	creds := deriveSigningKey(ctx.Region, ctx.ServiceName, ctx.credValues.SecretAccessKey, ctx.Time)
-	signature := hmacSHA256(creds, []byte(ctx.stringToSign))
+	secret := ctx.credValues.SecretAccessKey
+	date := makeHmac([]byte("AWS4"+secret), []byte(ctx.formattedShortTime))
+	region := makeHmac(date, []byte(ctx.Region))
+	service := makeHmac(region, []byte(ctx.ServiceName))
+	credentials := makeHmac(service, []byte("aws4_request"))
+	signature := makeHmac(credentials, []byte(ctx.stringToSign))
 	ctx.signature = hex.EncodeToString(signature)
 }
 
@@ -742,13 +726,13 @@ func (ctx *signingCtx) removePresign() {
 	ctx.Query.Del("X-Amz-SignedHeaders")
 }
 
-func hmacSHA256(key []byte, data []byte) []byte {
+func makeHmac(key []byte, data []byte) []byte {
 	hash := hmac.New(sha256.New, key)
 	hash.Write(data)
 	return hash.Sum(nil)
 }
 
-func hashSHA256(data []byte) []byte {
+func makeSha256(data []byte) []byte {
 	hash := sha256.New()
 	hash.Write(data)
 	return hash.Sum(nil)
@@ -820,28 +804,3 @@ func stripExcessSpaces(vals []string) {
 		vals[i] = string(buf[:m])
 	}
 }
-
-func buildSigningScope(region, service string, dt time.Time) string {
-	return strings.Join([]string{
-		formatShortTime(dt),
-		region,
-		service,
-		awsV4Request,
-	}, "/")
-}
-
-func deriveSigningKey(region, service, secretKey string, dt time.Time) []byte {
-	kDate := hmacSHA256([]byte("AWS4"+secretKey), []byte(formatShortTime(dt)))
-	kRegion := hmacSHA256(kDate, []byte(region))
-	kService := hmacSHA256(kRegion, []byte(service))
-	signingKey := hmacSHA256(kService, []byte(awsV4Request))
-	return signingKey
-}
-
-func formatShortTime(dt time.Time) string {
-	return dt.UTC().Format(shortTimeFormat)
-}
-
-func formatTime(dt time.Time) string {
-	return dt.UTC().Format(timeFormat)
-}

vendor/github.com/aws/aws-sdk-go/aws/types.go

@@ -2,7 +2,6 @@ package aws
 
 import (
 	"io"
-	"strings"
 	"sync"
 
 	"github.com/aws/aws-sdk-go/internal/sdkio"
@@ -206,36 +205,3 @@ func (b *WriteAtBuffer) Bytes() []byte {
 	defer b.m.Unlock()
 	return b.buf
 }
-
-// MultiCloser is a utility to close multiple io.Closers within a single
-// statement.
-type MultiCloser []io.Closer
-
-// Close closes all of the io.Closers making up the MultiClosers. Any
-// errors that occur while closing will be returned in the order they
-// occur.
-func (m MultiCloser) Close() error {
-	var errs errors
-	for _, c := range m {
-		err := c.Close()
-		if err != nil {
-			errs = append(errs, err)
-		}
-	}
-	if len(errs) != 0 {
-		return errs
-	}
-
-	return nil
-}
-
-type errors []error
-
-func (es errors) Error() string {
-	var parts []string
-	for _, e := range es {
-		parts = append(parts, e.Error())
-	}
-
-	return strings.Join(parts, "\n")
-}

vendor/github.com/aws/aws-sdk-go/aws/version.go

@@ -5,4 +5,4 @@ package aws
 const SDKName = "aws-sdk-go"
 
 // SDKVersion is the version of this SDK
-const SDKVersion = "1.27.1"
+const SDKVersion = "1.25.19"

vendor/github.com/aws/aws-sdk-go/private/protocol/eventstream/debug.go

@@ -101,7 +101,7 @@ func (hs *decodedHeaders) UnmarshalJSON(b []byte) error {
 		}
 		headers.Set(h.Name, value)
 	}
-	*hs = decodedHeaders(headers)
+	(*hs) = decodedHeaders(headers)
 
 	return nil
 }

vendor/github.com/aws/aws-sdk-go/private/protocol/eventstream/decode.go

@@ -21,24 +21,10 @@ type Decoder struct {
 
 // NewDecoder initializes and returns a Decoder for decoding event
 // stream messages from the reader provided.
-func NewDecoder(r io.Reader, opts ...func(*Decoder)) *Decoder {
-	d := &Decoder{
+func NewDecoder(r io.Reader) *Decoder {
+	return &Decoder{
 		r: r,
 	}
-
-	for _, opt := range opts {
-		opt(d)
-	}
-
-	return d
-}
-
-// DecodeWithLogger adds a logger to be used by the decoder when decoding
-// stream events.
-func DecodeWithLogger(logger aws.Logger) func(*Decoder) {
-	return func(d *Decoder) {
-		d.logger = logger
-	}
 }
 
 // Decode attempts to decode a single message from the event stream reader.
@@ -54,15 +40,6 @@ func (d *Decoder) Decode(payloadBuf []byte) (m Message, err error) {
 		}()
 	}
 
-	m, err = Decode(reader, payloadBuf)
-
-	return m, err
-}
-
-// Decode attempts to decode a single message from the event stream reader.
-// Will return the event stream message, or error if Decode fails to read
-// the message from the reader.
-func Decode(reader io.Reader, payloadBuf []byte) (m Message, err error) {
 	crc := crc32.New(crc32IEEETable)
 	hashReader := io.TeeReader(reader, crc)
 
@@ -95,6 +72,12 @@ func Decode(reader io.Reader, payloadBuf []byte) (m Message, err error) {
 	return m, nil
 }
 
+// UseLogger specifies the Logger that that the decoder should use to log the
+// message decode to.
+func (d *Decoder) UseLogger(logger aws.Logger) {
+	d.logger = logger
+}
+
 func logMessageDecode(logger aws.Logger, msgBuf *bytes.Buffer, msg Message, decodeErr error) {
 	w := bytes.NewBuffer(nil)
 	defer func() { logger.Log(w.String()) }()

vendor/github.com/aws/aws-sdk-go/private/protocol/eventstream/encode.go

@@ -3,107 +3,61 @@ package eventstream
 import (
 	"bytes"
 	"encoding/binary"
-	"encoding/hex"
-	"encoding/json"
-	"fmt"
 	"hash"
 	"hash/crc32"
 	"io"
-
-	"github.com/aws/aws-sdk-go/aws"
 )
 
 // Encoder provides EventStream message encoding.
 type Encoder struct {
-	w      io.Writer
-	logger aws.Logger
+	w io.Writer
 
 	headersBuf *bytes.Buffer
 }
 
 // NewEncoder initializes and returns an Encoder to encode Event Stream
 // messages to an io.Writer.
-func NewEncoder(w io.Writer, opts ...func(*Encoder)) *Encoder {
-	e := &Encoder{
+func NewEncoder(w io.Writer) *Encoder {
+	return &Encoder{
 		w:          w,
 		headersBuf: bytes.NewBuffer(nil),
 	}
-
-	for _, opt := range opts {
-		opt(e)
-	}
-
-	return e
-}
-
-// EncodeWithLogger adds a logger to be used by the encode when decoding
-// stream events.
-func EncodeWithLogger(logger aws.Logger) func(*Encoder) {
-	return func(d *Encoder) {
-		d.logger = logger
-	}
 }
 
 // Encode encodes a single EventStream message to the io.Writer the Encoder
 // was created with. An error is returned if writing the message fails.
-func (e *Encoder) Encode(msg Message) (err error) {
+func (e *Encoder) Encode(msg Message) error {
 	e.headersBuf.Reset()
 
-	writer := e.w
-	if e.logger != nil {
-		encodeMsgBuf := bytes.NewBuffer(nil)
-		writer = io.MultiWriter(writer, encodeMsgBuf)
-		defer func() {
-			logMessageEncode(e.logger, encodeMsgBuf, msg, err)
-		}()
-	}
-
-	if err = EncodeHeaders(e.headersBuf, msg.Headers); err != nil {
+	err := encodeHeaders(e.headersBuf, msg.Headers)
+	if err != nil {
 		return err
 	}
 
 	crc := crc32.New(crc32IEEETable)
-	hashWriter := io.MultiWriter(writer, crc)
+	hashWriter := io.MultiWriter(e.w, crc)
 
 	headersLen := uint32(e.headersBuf.Len())
 	payloadLen := uint32(len(msg.Payload))
 
-	if err = encodePrelude(hashWriter, crc, headersLen, payloadLen); err != nil {
+	if err := encodePrelude(hashWriter, crc, headersLen, payloadLen); err != nil {
 		return err
 	}
 
 	if headersLen > 0 {
-		if _, err = io.Copy(hashWriter, e.headersBuf); err != nil {
+		if _, err := io.Copy(hashWriter, e.headersBuf); err != nil {
 			return err
 		}
 	}
 
 	if payloadLen > 0 {
-		if _, err = hashWriter.Write(msg.Payload); err != nil {
+		if _, err := hashWriter.Write(msg.Payload); err != nil {
 			return err
 		}
 	}
 
 	msgCRC := crc.Sum32()
-	return binary.Write(writer, binary.BigEndian, msgCRC)
-}
-
-func logMessageEncode(logger aws.Logger, msgBuf *bytes.Buffer, msg Message, encodeErr error) {
-	w := bytes.NewBuffer(nil)
-	defer func() { logger.Log(w.String()) }()
-
-	fmt.Fprintf(w, "Message to encode:\n")
-	encoder := json.NewEncoder(w)
-	if err := encoder.Encode(msg); err != nil {
-		fmt.Fprintf(w, "Failed to get encoded message, %v\n", err)
-	}
-
-	if encodeErr != nil {
-		fmt.Fprintf(w, "Encode error: %v\n", encodeErr)
-		return
-	}
-
-	fmt.Fprintf(w, "Raw message:\n%s\n", hex.Dump(msgBuf.Bytes()))
+	return binary.Write(e.w, binary.BigEndian, msgCRC)
 }
 
 func encodePrelude(w io.Writer, crc hash.Hash32, headersLen, payloadLen uint32) error {
@@ -132,9 +86,7 @@ func encodePrelude(w io.Writer, crc hash.Hash32, headersLen, payloadLen uint32)
 	return nil
 }
 
-// EncodeHeaders writes the header values to the writer encoded in the event
-// stream format. Returns an error if a header fails to encode.
-func EncodeHeaders(w io.Writer, headers Headers) error {
+func encodeHeaders(w io.Writer, headers Headers) error {
 	for _, h := range headers {
 		hn := headerName{
 			Len: uint8(len(h.Name)),

vendor/github.com/aws/aws-sdk-go/private/protocol/eventstream/eventstreamapi/api.go

@@ -2,7 +2,9 @@ package eventstreamapi
 
 import (
 	"fmt"
+	"io"
 
+	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/private/protocol"
 	"github.com/aws/aws-sdk-go/private/protocol/eventstream"
 )
@@ -13,8 +15,27 @@ type Unmarshaler interface {
 	UnmarshalEvent(protocol.PayloadUnmarshaler, eventstream.Message) error
 }
 
+// EventStream headers with specific meaning to async API functionality.
+const (
+	MessageTypeHeader    = `:message-type` // Identifies type of message.
+	EventMessageType     = `event`
+	ErrorMessageType     = `error`
+	ExceptionMessageType = `exception`
+
+	// Message Events
+	EventTypeHeader = `:event-type` // Identifies message event type e.g. "Stats".
+
+	// Message Error
+	ErrorCodeHeader    = `:error-code`
+	ErrorMessageHeader = `:error-message`
+
+	// Message Exception
+	ExceptionTypeHeader = `:exception-type`
+)
+
 // EventReader provides reading from the EventStream of an reader.
 type EventReader struct {
+	reader  io.ReadCloser
 	decoder *eventstream.Decoder
 
 	unmarshalerForEventType func(string) (Unmarshaler, error)
@@ -26,18 +47,27 @@ type EventReader struct {
 // NewEventReader returns a EventReader built from the reader and unmarshaler
 // provided.  Use ReadStream method to start reading from the EventStream.
 func NewEventReader(
-	decoder *eventstream.Decoder,
+	reader io.ReadCloser,
 	payloadUnmarshaler protocol.PayloadUnmarshaler,
 	unmarshalerForEventType func(string) (Unmarshaler, error),
 ) *EventReader {
 	return &EventReader{
-		decoder:                 decoder,
+		reader:                  reader,
+		decoder:                 eventstream.NewDecoder(reader),
 		payloadUnmarshaler:      payloadUnmarshaler,
 		unmarshalerForEventType: unmarshalerForEventType,
 		payloadBuf:              make([]byte, 10*1024),
 	}
 }
 
+// UseLogger instructs the EventReader to use the logger and log level
+// specified.
+func (r *EventReader) UseLogger(logger aws.Logger, logLevel aws.LogLevelType) {
+	if logger != nil && logLevel.Matches(aws.LogDebugWithEventStreamBody) {
+		r.decoder.UseLogger(logger)
+	}
+}
+
 // ReadEvent attempts to read a message from the EventStream and return the
 // unmarshaled event value that the message is for.
 //
@@ -65,7 +95,8 @@ func (r *EventReader) ReadEvent() (event interface{}, err error) {
 	case EventMessageType:
 		return r.unmarshalEventMessage(msg)
 	case ExceptionMessageType:
-		return nil, r.unmarshalEventException(msg)
+		err = r.unmarshalEventException(msg)
+		return nil, err
 	case ErrorMessageType:
 		return nil, r.unmarshalErrorMessage(msg)
 	default:
@@ -143,6 +174,11 @@ func (r *EventReader) unmarshalErrorMessage(msg eventstream.Message) (err error)
 	return msgErr
 }
 
+// Close closes the EventReader's EventStream reader.
+func (r *EventReader) Close() error {
+	return r.reader.Close()
+}
+
 // GetHeaderString returns the value of the header as a string. If the header
 // is not set or the value is not a string an error will be returned.
 func GetHeaderString(msg eventstream.Message, headerName string) (string, error) {

vendor/github.com/aws/aws-sdk-go/private/protocol/eventstream/eventstreamapi/error.go

@@ -1,9 +1,6 @@
 package eventstreamapi
 
-import (
-	"fmt"
-	"sync"
-)
+import "fmt"
 
 type messageError struct {
 	code string
@@ -25,53 +22,3 @@ func (e messageError) Error() string {
 func (e messageError) OrigErr() error {
 	return nil
 }
-
-// OnceError wraps the behavior of recording an error
-// once and signal on a channel when this has occurred.
-// Signaling is done by closing of the channel.
-//
-// Type is safe for concurrent usage.
-type OnceError struct {
-	mu  sync.RWMutex
-	err error
-	ch  chan struct{}
-}
-
-// NewOnceError return a new OnceError
-func NewOnceError() *OnceError {
-	return &OnceError{
-		ch: make(chan struct{}, 1),
-	}
-}
-
-// Err acquires a read-lock and returns an
-// error if one has been set.
-func (e *OnceError) Err() error {
-	e.mu.RLock()
-	err := e.err
-	e.mu.RUnlock()
-
-	return err
-}
-
-// SetError acquires a write-lock and will set
-// the underlying error value if one has not been set.
-func (e *OnceError) SetError(err error) {
-	if err == nil {
-		return
-	}
-
-	e.mu.Lock()
-	if e.err == nil {
-		e.err = err
-		close(e.ch)
-	}
-	e.mu.Unlock()
-}
-
-// ErrorSet returns a channel that will be used to signal
-// that an error has been set. This channel will be closed
-// when the error value has been set for OnceError.
-func (e *OnceError) ErrorSet() <-chan struct{} {
-	return e.ch
-}

vendor/github.com/aws/aws-sdk-go/private/protocol/eventstream/eventstreamapi/shared.go

@@ -1,23 +0,0 @@
-package eventstreamapi
-
-// EventStream headers with specific meaning to async API functionality.
-const (
-	ChunkSignatureHeader = `:chunk-signature` // chunk signature for message
-	DateHeader           = `:date`            // Date header for signature
-
-	// Message header and values
-	MessageTypeHeader    = `:message-type` // Identifies type of message.
-	EventMessageType     = `event`
-	ErrorMessageType     = `error`
-	ExceptionMessageType = `exception`
-
-	// Message Events
-	EventTypeHeader = `:event-type` // Identifies message event type e.g. "Stats".
-
-	// Message Error
-	ErrorCodeHeader    = `:error-code`
-	ErrorMessageHeader = `:error-message`
-
-	// Message Exception
-	ExceptionTypeHeader = `:exception-type`
-)

vendor/github.com/aws/aws-sdk-go/private/protocol/eventstream/eventstreamapi/signer.go

@@ -1,123 +0,0 @@
-package eventstreamapi
-
-import (
-	"bytes"
-	"strings"
-	"time"
-
-	"github.com/aws/aws-sdk-go/private/protocol/eventstream"
-)
-
-var timeNow = time.Now
-
-// StreamSigner defines an interface for the implementation of signing of event stream payloads
-type StreamSigner interface {
-	GetSignature(headers, payload []byte, date time.Time) ([]byte, error)
-}
-
-// SignEncoder envelopes event stream messages
-// into an event stream message payload with included
-// signature headers using the provided signer and encoder.
-type SignEncoder struct {
-	signer     StreamSigner
-	encoder    Encoder
-	bufEncoder *BufferEncoder
-
-	closeErr error
-	closed   bool
-}
-
-// NewSignEncoder returns a new SignEncoder using the provided stream signer and
-// event stream encoder.
-func NewSignEncoder(signer StreamSigner, encoder Encoder) *SignEncoder {
-	// TODO: Need to pass down logging
-
-	return &SignEncoder{
-		signer:     signer,
-		encoder:    encoder,
-		bufEncoder: NewBufferEncoder(),
-	}
-}
-
-// Close encodes a final event stream signing envelope with an empty event stream
-// payload. This final end-frame is used to mark the conclusion of the stream.
-func (s *SignEncoder) Close() error {
-	if s.closed {
-		return s.closeErr
-	}
-
-	if err := s.encode([]byte{}); err != nil {
-		if strings.Contains(err.Error(), "on closed pipe") {
-			return nil
-		}
-
-		s.closeErr = err
-		s.closed = true
-		return s.closeErr
-	}
-
-	return nil
-}
-
-// Encode takes the provided message and add envelopes the message
-// with the required signature.
-func (s *SignEncoder) Encode(msg eventstream.Message) error {
-	payload, err := s.bufEncoder.Encode(msg)
-	if err != nil {
-		return err
-	}
-
-	return s.encode(payload)
-}
-
-func (s SignEncoder) encode(payload []byte) error {
-	date := timeNow()
-
-	var msg eventstream.Message
-	msg.Headers.Set(DateHeader, eventstream.TimestampValue(date))
-	msg.Payload = payload
-
-	var headers bytes.Buffer
-	if err := eventstream.EncodeHeaders(&headers, msg.Headers); err != nil {
-		return err
-	}
-
-	sig, err := s.signer.GetSignature(headers.Bytes(), msg.Payload, date)
-	if err != nil {
-		return err
-	}
-
-	msg.Headers.Set(ChunkSignatureHeader, eventstream.BytesValue(sig))
-
-	return s.encoder.Encode(msg)
-}
-
-// BufferEncoder is a utility that provides a buffered
-// event stream encoder
-type BufferEncoder struct {
-	encoder Encoder
-	buffer  *bytes.Buffer
-}
-
-// NewBufferEncoder returns a new BufferEncoder initialized
-// with a 1024 byte buffer.
-func NewBufferEncoder() *BufferEncoder {
-	buf := bytes.NewBuffer(make([]byte, 1024))
-	return &BufferEncoder{
-		encoder: eventstream.NewEncoder(buf),
-		buffer:  buf,
-	}
-}
-
-// Encode returns the encoded message as a byte slice.
-// The returned byte slice will be modified on the next encode call
-// and should not be held onto.
-func (e *BufferEncoder) Encode(msg eventstream.Message) ([]byte, error) {
-	e.buffer.Reset()
-
-	if err := e.encoder.Encode(msg); err != nil {
-		return nil, err
-	}
-
-	return e.buffer.Bytes(), nil
-}

vendor/github.com/aws/aws-sdk-go/private/protocol/eventstream/eventstreamapi/stream_writer.go

@@ -1,129 +0,0 @@
-package eventstreamapi
-
-import (
-	"fmt"
-	"io"
-	"sync"
-
-	"github.com/aws/aws-sdk-go/aws"
-)
-
-// StreamWriter provides concurrent safe writing to an event stream.
-type StreamWriter struct {
-	eventWriter *EventWriter
-	stream      chan eventWriteAsyncReport
-
-	done      chan struct{}
-	closeOnce sync.Once
-	err       *OnceError
-
-	streamCloser io.Closer
-}
-
-// NewStreamWriter returns a StreamWriter for the event writer, and stream
-// closer provided.
-func NewStreamWriter(eventWriter *EventWriter, streamCloser io.Closer) *StreamWriter {
-	w := &StreamWriter{
-		eventWriter:  eventWriter,
-		streamCloser: streamCloser,
-		stream:       make(chan eventWriteAsyncReport),
-		done:         make(chan struct{}),
-		err:          NewOnceError(),
-	}
-	go w.writeStream()
-
-	return w
-}
-
-// Close terminates the writers ability to write new events to the stream. Any
-// future call to Send will fail with an error.
-func (w *StreamWriter) Close() error {
-	w.closeOnce.Do(w.safeClose)
-	return w.Err()
-}
-
-func (w *StreamWriter) safeClose() {
-	close(w.done)
-}
-
-// ErrorSet returns a channel which will be closed
-// if an error occurs.
-func (w *StreamWriter) ErrorSet() <-chan struct{} {
-	return w.err.ErrorSet()
-}
-
-// Err returns any error that occurred while attempting to write an event to the
-// stream.
-func (w *StreamWriter) Err() error {
-	return w.err.Err()
-}
-
-// Send writes a single event to the stream returning an error if the write
-// failed.
-//
-// Send may be called concurrently. Events will be written to the stream
-// safely.
-func (w *StreamWriter) Send(ctx aws.Context, event Marshaler) error {
-	if err := w.Err(); err != nil {
-		return err
-	}
-
-	resultCh := make(chan error)
-	wrapped := eventWriteAsyncReport{
-		Event:  event,
-		Result: resultCh,
-	}
-
-	select {
-	case w.stream <- wrapped:
-	case <-ctx.Done():
-		return ctx.Err()
-	case <-w.done:
-		return fmt.Errorf("stream closed, unable to send event")
-	}
-
-	select {
-	case err := <-resultCh:
-		return err
-	case <-ctx.Done():
-		return ctx.Err()
-	case <-w.done:
-		return fmt.Errorf("stream closed, unable to send event")
-	}
-}
-
-func (w *StreamWriter) writeStream() {
-	defer w.Close()
-
-	for {
-		select {
-		case wrapper := <-w.stream:
-			err := w.eventWriter.WriteEvent(wrapper.Event)
-			wrapper.ReportResult(w.done, err)
-			if err != nil {
-				w.err.SetError(err)
-				return
-			}
-
-		case <-w.done:
-			if err := w.streamCloser.Close(); err != nil {
-				w.err.SetError(err)
-			}
-			return
-		}
-	}
-}
-
-type eventWriteAsyncReport struct {
-	Event  Marshaler
-	Result chan<- error
-}
-
-func (e eventWriteAsyncReport) ReportResult(cancel <-chan struct{}, err error) bool {
-	select {
-	case e.Result <- err:
-		return true
-	case <-cancel:
-		return false
-	}
-}

vendor/github.com/aws/aws-sdk-go/private/protocol/eventstream/eventstreamapi/writer.go

@@ -1,109 +0,0 @@
-package eventstreamapi
-
-import (
-	"github.com/aws/aws-sdk-go/private/protocol"
-	"github.com/aws/aws-sdk-go/private/protocol/eventstream"
-)
-
-// Marshaler provides a marshaling interface for event types to event stream
-// messages.
-type Marshaler interface {
-	MarshalEvent(protocol.PayloadMarshaler) (eventstream.Message, error)
-}
-
-// Encoder is an stream encoder that will encode an event stream message for
-// the transport.
-type Encoder interface {
-	Encode(eventstream.Message) error
-}
-
-// EventWriter provides a wrapper around the underlying event stream encoder
-// for an io.WriteCloser.
-type EventWriter struct {
-	encoder          Encoder
-	payloadMarshaler protocol.PayloadMarshaler
-	eventTypeFor     func(Marshaler) (string, error)
-}
-
-// NewEventWriter returns a new event stream writer, that will write to the
-// writer provided. Use the WriteEvent method to write an event to the stream.
-func NewEventWriter(encoder Encoder, pm protocol.PayloadMarshaler, eventTypeFor func(Marshaler) (string, error),
-) *EventWriter {
-	return &EventWriter{
-		encoder:          encoder,
-		payloadMarshaler: pm,
-		eventTypeFor:     eventTypeFor,
-	}
-}
-
-// WriteEvent writes an event to the stream. Returns an error if the event
-// fails to marshal into a message, or writing to the underlying writer fails.
-func (w *EventWriter) WriteEvent(event Marshaler) error {
-	msg, err := w.marshal(event)
-	if err != nil {
-		return err
-	}
-
-	return w.encoder.Encode(msg)
-}
-
-func (w *EventWriter) marshal(event Marshaler) (eventstream.Message, error) {
-	eventType, err := w.eventTypeFor(event)
-	if err != nil {
-		return eventstream.Message{}, err
-	}
-
-	msg, err := event.MarshalEvent(w.payloadMarshaler)
-	if err != nil {
-		return eventstream.Message{}, err
-	}
-
-	msg.Headers.Set(EventTypeHeader, eventstream.StringValue(eventType))
-	return msg, nil
-}
-
-//type EventEncoder struct {
-//	encoder           Encoder
-//	ppayloadMarshaler protocol.PayloadMarshaler
-//	eventTypeFor      func(Marshaler) (string, error)
-//}
-//
-//func (e EventEncoder) Encode(event Marshaler) error {
-//	msg, err := e.marshal(event)
-//	if err != nil {
-//		return err
-//	}
-//
-//	return w.encoder.Encode(msg)
-//}
-//
-//func (e EventEncoder) marshal(event Marshaler) (eventstream.Message, error) {
-//	eventType, err := w.eventTypeFor(event)
-//	if err != nil {
-//		return eventstream.Message{}, err
-//	}
-//
-//	msg, err := event.MarshalEvent(w.payloadMarshaler)
-//	if err != nil {
-//		return eventstream.Message{}, err
-//	}
-//
-//	msg.Headers.Set(EventTypeHeader, eventstream.StringValue(eventType))
-//	return msg, nil
-//}
-//
-//func (w *EventWriter) marshal(event Marshaler) (eventstream.Message, error) {
-//	eventType, err := w.eventTypeFor(event)
-//	if err != nil {
-//		return eventstream.Message{}, err
-//	}
-//
-//	msg, err := event.MarshalEvent(w.payloadMarshaler)
-//	if err != nil {
-//		return eventstream.Message{}, err
-//	}
-//
-//	msg.Headers.Set(EventTypeHeader, eventstream.StringValue(eventType))
-//	return msg, nil
-//}
-//

vendor/github.com/aws/aws-sdk-go/private/protocol/eventstream/header_value.go

@@ -461,11 +461,6 @@ func (v *TimestampValue) decode(r io.Reader) error {
 	return nil
 }
 
-// MarshalJSON implements the json.Marshaler interface
-func (v TimestampValue) MarshalJSON() ([]byte, error) {
-	return []byte(v.String()), nil
-}
-
 func timeFromEpochMilli(t int64) time.Time {
 	secs := t / 1e3
 	msec := t % 1e3

vendor/github.com/aws/aws-sdk-go/private/protocol/eventstream/message.go

@@ -27,7 +27,7 @@ func (m *Message) rawMessage() (rawMessage, error) {
 
 	if len(m.Headers) > 0 {
 		var headers bytes.Buffer
-		if err := EncodeHeaders(&headers, m.Headers); err != nil {
+		if err := encodeHeaders(&headers, m.Headers); err != nil {
 			return rawMessage{}, err
 		}
 		raw.Headers = headers.Bytes()

vendor/github.com/aws/aws-sdk-go/private/protocol/payload.go

@@ -64,7 +64,7 @@ func (h HandlerPayloadMarshal) MarshalPayload(w io.Writer, v interface{}) error
 		metadata.ClientInfo{},
 		request.Handlers{},
 		nil,
-		&request.Operation{HTTPMethod: "PUT"},
+		&request.Operation{HTTPMethod: "GET"},
 		v,
 		nil,
 	)

vendor/github.com/aws/aws-sdk-go/private/protocol/protocol.go

@@ -1,49 +0,0 @@
-package protocol
-
-import (
-	"fmt"
-	"strings"
-
-	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/aws/request"
-)
-
-// RequireHTTPMinProtocol request handler is used to enforce that
-// the target endpoint supports the given major and minor HTTP protocol version.
-type RequireHTTPMinProtocol struct {
-	Major, Minor int
-}
-
-// Handler will mark the request.Request with an error if the
-// target endpoint did not connect with the required HTTP protocol
-// major and minor version.
-func (p RequireHTTPMinProtocol) Handler(r *request.Request) {
-	if r.Error != nil || r.HTTPResponse == nil {
-		return
-	}
-
-	if !strings.HasPrefix(r.HTTPResponse.Proto, "HTTP") {
-		r.Error = newMinHTTPProtoError(p.Major, p.Minor, r)
-	}
-
-	if r.HTTPResponse.ProtoMajor < p.Major || r.HTTPResponse.ProtoMinor < p.Minor {
-		r.Error = newMinHTTPProtoError(p.Major, p.Minor, r)
-	}
-}
-
-// ErrCodeMinimumHTTPProtocolError error code is returned when the target endpoint
-// did not match the required HTTP major and minor protocol version.
-const ErrCodeMinimumHTTPProtocolError = "MinimumHTTPProtocolError"
-
-func newMinHTTPProtoError(major, minor int, r *request.Request) error {
-	return awserr.NewRequestFailure(
-		awserr.New("MinimumHTTPProtocolError",
-			fmt.Sprintf(
-				"operation requires minimum HTTP protocol of HTTP/%d.%d, but was %s",
-				major, minor, r.HTTPResponse.Proto,
-			),
-			nil,
-		),
-		r.HTTPResponse.StatusCode, r.RequestID,
-	)
-}

vendor/github.com/aws/aws-sdk-go/service/ecr/errors.go

@@ -140,13 +140,6 @@ const (
 	// repository policy.
 	ErrCodeRepositoryPolicyNotFoundException = "RepositoryPolicyNotFoundException"
 
-	// ErrCodeScanNotFoundException for service response error code
-	// "ScanNotFoundException".
-	//
-	// The specified image scan could not be found. Ensure that image scanning is
-	// enabled on the repository and try again.
-	ErrCodeScanNotFoundException = "ScanNotFoundException"
-
 	// ErrCodeServerException for service response error code
 	// "ServerException".
 	//

vendor/github.com/aws/aws-sdk-go/service/ecr/service.go

@@ -31,7 +31,7 @@ var initRequest func(*request.Request)
 const (
 	ServiceName = "ecr"     // Name of service.
 	EndpointsID = "api.ecr" // ID to lookup a service endpoint with.
-	ServiceID   = "ECR"     // ServiceID is a unique identifier of a specific service.
+	ServiceID   = "ECR"     // ServiceID is a unique identifer of a specific service.
 )
 
 // New creates a new instance of the ECR client with a session.
@@ -39,8 +39,6 @@ const (
 // aws.Config parameter to add your extra config.
 //
 // Example:
-//     mySession := session.Must(session.NewSession())
-//
 //     // Create a ECR client from just a session.
 //     svc := ecr.New(mySession)
 //
@@ -51,11 +49,11 @@ func New(p client.ConfigProvider, cfgs ...*aws.Config) *ECR {
 	if c.SigningNameDerived || len(c.SigningName) == 0 {
 		c.SigningName = "ecr"
 	}
-	return newClient(*c.Config, c.Handlers, c.PartitionID, c.Endpoint, c.SigningRegion, c.SigningName)
+	return newClient(*c.Config, c.Handlers, c.Endpoint, c.SigningRegion, c.SigningName)
 }
 
 // newClient creates, initializes and returns a new service client instance.
-func newClient(cfg aws.Config, handlers request.Handlers, partitionID, endpoint, signingRegion, signingName string) *ECR {
+func newClient(cfg aws.Config, handlers request.Handlers, endpoint, signingRegion, signingName string) *ECR {
 	svc := &ECR{
 		Client: client.New(
 			cfg,
@@ -64,7 +62,6 @@ func newClient(cfg aws.Config, handlers request.Handlers, partitionID, endpoint,
 				ServiceID:     ServiceID,
 				SigningName:   signingName,
 				SigningRegion: signingRegion,
-				PartitionID:   partitionID,
 				Endpoint:      endpoint,
 				APIVersion:    "2015-09-21",
 				JSONVersion:   "1.1",

vendor/github.com/aws/aws-sdk-go/service/ecr/waiters.go

@@ -1,112 +0,0 @@
-// Code generated by private/model/cli/gen-api/main.go. DO NOT EDIT.
-
-package ecr
-
-import (
-	"time"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/request"
-)
-
-// WaitUntilImageScanComplete uses the Amazon ECR API operation
-// DescribeImageScanFindings to wait for a condition to be met before returning.
-// If the condition is not met within the max attempt window, an error will
-// be returned.
-func (c *ECR) WaitUntilImageScanComplete(input *DescribeImageScanFindingsInput) error {
-	return c.WaitUntilImageScanCompleteWithContext(aws.BackgroundContext(), input)
-}
-
-// WaitUntilImageScanCompleteWithContext is an extended version of WaitUntilImageScanComplete.
-// With the support for passing in a context and options to configure the
-// Waiter and the underlying request options.
-//
-// The context must be non-nil and will be used for request cancellation. If
-// the context is nil a panic will occur. In the future the SDK may create
-// sub-contexts for http.Requests. See https://golang.org/pkg/context/
-// for more information on using Contexts.
-func (c *ECR) WaitUntilImageScanCompleteWithContext(ctx aws.Context, input *DescribeImageScanFindingsInput, opts ...request.WaiterOption) error {
-	w := request.Waiter{
-		Name:        "WaitUntilImageScanComplete",
-		MaxAttempts: 60,
-		Delay:       request.ConstantWaiterDelay(5 * time.Second),
-		Acceptors: []request.WaiterAcceptor{
-			{
-				State:   request.SuccessWaiterState,
-				Matcher: request.PathWaiterMatch, Argument: "imageScanStatus.status",
-				Expected: "COMPLETE",
-			},
-			{
-				State:   request.FailureWaiterState,
-				Matcher: request.PathWaiterMatch, Argument: "imageScanStatus.status",
-				Expected: "FAILED",
-			},
-		},
-		Logger: c.Config.Logger,
-		NewRequest: func(opts []request.Option) (*request.Request, error) {
-			var inCpy *DescribeImageScanFindingsInput
-			if input != nil {
-				tmp := *input
-				inCpy = &tmp
-			}
-			req, _ := c.DescribeImageScanFindingsRequest(inCpy)
-			req.SetContext(ctx)
-			req.ApplyOptions(opts...)
-			return req, nil
-		},
-	}
-	w.ApplyOptions(opts...)
-
-	return w.WaitWithContext(ctx)
-}
-
-// WaitUntilLifecyclePolicyPreviewComplete uses the Amazon ECR API operation
-// GetLifecyclePolicyPreview to wait for a condition to be met before returning.
-// If the condition is not met within the max attempt window, an error will
-// be returned.
-func (c *ECR) WaitUntilLifecyclePolicyPreviewComplete(input *GetLifecyclePolicyPreviewInput) error {
-	return c.WaitUntilLifecyclePolicyPreviewCompleteWithContext(aws.BackgroundContext(), input)
-}
-
-// WaitUntilLifecyclePolicyPreviewCompleteWithContext is an extended version of WaitUntilLifecyclePolicyPreviewComplete.
-// With the support for passing in a context and options to configure the
-// Waiter and the underlying request options.
-//
-// The context must be non-nil and will be used for request cancellation. If
-// the context is nil a panic will occur. In the future the SDK may create
-// sub-contexts for http.Requests. See https://golang.org/pkg/context/
-// for more information on using Contexts.
-func (c *ECR) WaitUntilLifecyclePolicyPreviewCompleteWithContext(ctx aws.Context, input *GetLifecyclePolicyPreviewInput, opts ...request.WaiterOption) error {
-	w := request.Waiter{
-		Name:        "WaitUntilLifecyclePolicyPreviewComplete",
-		MaxAttempts: 20,
-		Delay:       request.ConstantWaiterDelay(5 * time.Second),
-		Acceptors: []request.WaiterAcceptor{
-			{
-				State:   request.SuccessWaiterState,
-				Matcher: request.PathWaiterMatch, Argument: "status",
-				Expected: "COMPLETE",
-			},
-			{
-				State:   request.FailureWaiterState,
-				Matcher: request.PathWaiterMatch, Argument: "status",
-				Expected: "FAILED",
-			},
-		},
-		Logger: c.Config.Logger,
-		NewRequest: func(opts []request.Option) (*request.Request, error) {
-			var inCpy *GetLifecyclePolicyPreviewInput
-			if input != nil {
-				tmp := *input
-				inCpy = &tmp
-			}
-			req, _ := c.GetLifecyclePolicyPreviewRequest(inCpy)
-			req.SetContext(ctx)
-			req.ApplyOptions(opts...)
-			return req, nil
-		},
-	}
-	w.ApplyOptions(opts...)
-
-	return w.WaitWithContext(ctx)
-}

vendor/github.com/aws/aws-sdk-go/service/s3/customizations.go

@@ -4,7 +4,6 @@ import (
 	"github.com/aws/aws-sdk-go/aws/client"
 	"github.com/aws/aws-sdk-go/aws/request"
 	"github.com/aws/aws-sdk-go/internal/s3err"
-	"github.com/aws/aws-sdk-go/service/s3/internal/arn"
 )
 
 func init() {
@@ -14,7 +13,7 @@ func init() {
 
 func defaultInitClientFn(c *client.Client) {
 	// Support building custom endpoints based on config
-	c.Handlers.Build.PushFront(endpointHandler)
+	c.Handlers.Build.PushFront(updateEndpointForS3Config)
 
 	// Require SSL when using SSE keys
 	c.Handlers.Validate.PushBack(validateSSERequiresSSL)
@@ -28,7 +27,7 @@ func defaultInitClientFn(c *client.Client) {
 }
 
 func defaultInitRequestFn(r *request.Request) {
-	// Add request handlers for specific platforms.
+	// Add reuest handlers for specific platforms.
 	// e.g. 100-continue support for PUT requests using Go 1.6
 	platformRequestHandlers(r)
 
@@ -74,8 +73,3 @@ type sseCustomerKeyGetter interface {
 type copySourceSSECustomerKeyGetter interface {
 	getCopySourceSSECustomerKey() string
 }
-
-type endpointARNGetter interface {
-	getEndpointARN() (arn.Resource, error)
-	hasEndpointARN() bool
-}

vendor/github.com/aws/aws-sdk-go/service/s3/endpoint.go

@@ -1,233 +0,0 @@
-package s3
-
-import (
-	"net/url"
-	"strings"
-
-	"github.com/aws/aws-sdk-go/aws"
-	awsarn "github.com/aws/aws-sdk-go/aws/arn"
-	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/aws/endpoints"
-	"github.com/aws/aws-sdk-go/aws/request"
-	"github.com/aws/aws-sdk-go/private/protocol"
-	"github.com/aws/aws-sdk-go/service/s3/internal/arn"
-)
-
-// Used by shapes with members decorated as endpoint ARN.
-func parseEndpointARN(v string) (arn.Resource, error) {
-	return arn.ParseResource(v, accessPointResourceParser)
-}
-
-func accessPointResourceParser(a awsarn.ARN) (arn.Resource, error) {
-	resParts := arn.SplitResource(a.Resource)
-	switch resParts[0] {
-	case "accesspoint":
-		return arn.ParseAccessPointResource(a, resParts[1:])
-	default:
-		return nil, arn.InvalidARNError{ARN: a, Reason: "unknown resource type"}
-	}
-}
-
-func endpointHandler(req *request.Request) {
-	endpoint, ok := req.Params.(endpointARNGetter)
-	if !ok || !endpoint.hasEndpointARN() {
-		updateBucketEndpointFromParams(req)
-		return
-	}
-
-	resource, err := endpoint.getEndpointARN()
-	if err != nil {
-		req.Error = newInvalidARNError(nil, err)
-		return
-	}
-
-	resReq := resourceRequest{
-		Resource: resource,
-		Request:  req,
-	}
-
-	if resReq.IsCrossPartition() {
-		req.Error = newClientPartitionMismatchError(resource,
-			req.ClientInfo.PartitionID, aws.StringValue(req.Config.Region), nil)
-		return
-	}
-
-	if !resReq.AllowCrossRegion() && resReq.IsCrossRegion() {
-		req.Error = newClientRegionMismatchError(resource,
-			req.ClientInfo.PartitionID, aws.StringValue(req.Config.Region), nil)
-		return
-	}
-
-	if resReq.HasCustomEndpoint() {
-		req.Error = newInvalidARNWithCustomEndpointError(resource, nil)
-		return
-	}
-
-	switch tv := resource.(type) {
-	case arn.AccessPointARN:
-		err = updateRequestAccessPointEndpoint(req, tv)
-		if err != nil {
-			req.Error = err
-		}
-	default:
-		req.Error = newInvalidARNError(resource, nil)
-	}
-}
-
-type resourceRequest struct {
-	Resource arn.Resource
-	Request  *request.Request
-}
-
-func (r resourceRequest) ARN() awsarn.ARN {
-	return r.Resource.GetARN()
-}
-
-func (r resourceRequest) AllowCrossRegion() bool {
-	return aws.BoolValue(r.Request.Config.S3UseARNRegion)
-}
-
-func (r resourceRequest) UseFIPS() bool {
-	return isFIPS(aws.StringValue(r.Request.Config.Region))
-}
-
-func (r resourceRequest) IsCrossPartition() bool {
-	return r.Request.ClientInfo.PartitionID != r.Resource.GetARN().Partition
-}
-
-func (r resourceRequest) IsCrossRegion() bool {
-	return isCrossRegion(r.Request, r.Resource.GetARN().Region)
-}
-
-func (r resourceRequest) HasCustomEndpoint() bool {
-	return len(aws.StringValue(r.Request.Config.Endpoint)) > 0
-}
-
-func isFIPS(clientRegion string) bool {
-	return strings.HasPrefix(clientRegion, "fips-") || strings.HasSuffix(clientRegion, "-fips")
-}
-func isCrossRegion(req *request.Request, otherRegion string) bool {
-	return req.ClientInfo.SigningRegion != otherRegion
-}
-
-func updateBucketEndpointFromParams(r *request.Request) {
-	bucket, ok := bucketNameFromReqParams(r.Params)
-	if !ok {
-		// Ignore operation requests if the bucket name was not provided
-		// if this is an input validation error the validation handler
-		// will report it.
-		return
-	}
-	updateEndpointForS3Config(r, bucket)
-}
-
-func updateRequestAccessPointEndpoint(req *request.Request, accessPoint arn.AccessPointARN) error {
-	// Accelerate not supported
-	if aws.BoolValue(req.Config.S3UseAccelerate) {
-		return newClientConfiguredForAccelerateError(accessPoint,
-			req.ClientInfo.PartitionID, aws.StringValue(req.Config.Region), nil)
-	}
-
-	// Ignore the disable host prefix for access points since custom endpoints
-	// are not supported.
-	req.Config.DisableEndpointHostPrefix = aws.Bool(false)
-
-	if err := accessPointEndpointBuilder(accessPoint).Build(req); err != nil {
-		return err
-	}
-
-	removeBucketFromPath(req.HTTPRequest.URL)
-
-	return nil
-}
-
-func removeBucketFromPath(u *url.URL) {
-	u.Path = strings.Replace(u.Path, "/{Bucket}", "", -1)
-	if u.Path == "" {
-		u.Path = "/"
-	}
-}
-
-type accessPointEndpointBuilder arn.AccessPointARN
-
-const (
-	accessPointPrefixLabel   = "accesspoint"
-	accountIDPrefixLabel     = "accountID"
-	accesPointPrefixTemplate = "{" + accessPointPrefixLabel + "}-{" + accountIDPrefixLabel + "}."
-)
-
-func (a accessPointEndpointBuilder) Build(req *request.Request) error {
-	resolveRegion := arn.AccessPointARN(a).Region
-	cfgRegion := aws.StringValue(req.Config.Region)
-
-	if isFIPS(cfgRegion) {
-		if aws.BoolValue(req.Config.S3UseARNRegion) && isCrossRegion(req, resolveRegion) {
-			// FIPS with cross region is not supported, the SDK must fail
-			// because there is no well defined method for SDK to construct a
-			// correct FIPS endpoint.
-			return newClientConfiguredForCrossRegionFIPSError(arn.AccessPointARN(a),
-				req.ClientInfo.PartitionID, cfgRegion, nil)
-		}
-		resolveRegion = cfgRegion
-	}
-
-	endpoint, err := resolveRegionalEndpoint(req, resolveRegion)
-	if err != nil {
-		return newFailedToResolveEndpointError(arn.AccessPointARN(a),
-			req.ClientInfo.PartitionID, cfgRegion, err)
-	}
-
-	if err = updateRequestEndpoint(req, endpoint.URL); err != nil {
-		return err
-	}
-
-	const serviceEndpointLabel = "s3-accesspoint"
-
-	// dualstack provided by endpoint resolver
-	cfgHost := req.HTTPRequest.URL.Host
-	if strings.HasPrefix(cfgHost, "s3") {
-		req.HTTPRequest.URL.Host = serviceEndpointLabel + cfgHost[2:]
-	}
-
-	protocol.HostPrefixBuilder{
-		Prefix:   accesPointPrefixTemplate,
-		LabelsFn: a.hostPrefixLabelValues,
-	}.Build(req)
-
-	req.ClientInfo.SigningName = endpoint.SigningName
-	req.ClientInfo.SigningRegion = endpoint.SigningRegion
-
-	err = protocol.ValidateEndpointHost(req.Operation.Name, req.HTTPRequest.URL.Host)
-	if err != nil {
-		return newInvalidARNError(arn.AccessPointARN(a), err)
-	}
-
-	return nil
-}
-
-func (a accessPointEndpointBuilder) hostPrefixLabelValues() map[string]string {
-	return map[string]string{
-		accessPointPrefixLabel: arn.AccessPointARN(a).AccessPointName,
-		accountIDPrefixLabel:   arn.AccessPointARN(a).AccountID,
-	}
-}
-
-func resolveRegionalEndpoint(r *request.Request, region string) (endpoints.ResolvedEndpoint, error) {
-	return r.Config.EndpointResolver.EndpointFor(EndpointsID, region, func(opts *endpoints.Options) {
-		opts.DisableSSL = aws.BoolValue(r.Config.DisableSSL)
-		opts.UseDualStack = aws.BoolValue(r.Config.UseDualStack)
-		opts.S3UsEast1RegionalEndpoint = endpoints.RegionalS3UsEast1Endpoint
-	})
-}
-
-func updateRequestEndpoint(r *request.Request, endpoint string) (err error) {
-	endpoint = endpoints.AddScheme(endpoint, aws.BoolValue(r.Config.DisableSSL))
-
-	r.HTTPRequest.URL, err = url.Parse(endpoint + r.Operation.HTTPPath)
-	if err != nil {
-		return awserr.New(request.ErrCodeSerialization,
-			"failed to parse endpoint URL", err)
-	}
-
-	return nil
-}

vendor/github.com/aws/aws-sdk-go/service/s3/endpoint_errors.go

@@ -1,151 +0,0 @@
-package s3
-
-import (
-	"fmt"
-
-	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/service/s3/internal/arn"
-)
-
-const (
-	invalidARNErrorErrCode    = "InvalidARNError"
-	configurationErrorErrCode = "ConfigurationError"
-)
-
-type invalidARNError struct {
-	message  string
-	resource arn.Resource
-	origErr  error
-}
-
-func (e invalidARNError) Error() string {
-	var extra string
-	if e.resource != nil {
-		extra = "ARN: " + e.resource.String()
-	}
-	return awserr.SprintError(e.Code(), e.Message(), extra, e.origErr)
-}
-
-func (e invalidARNError) Code() string {
-	return invalidARNErrorErrCode
-}
-
-func (e invalidARNError) Message() string {
-	return e.message
-}
-
-func (e invalidARNError) OrigErr() error {
-	return e.origErr
-}
-
-func newInvalidARNError(resource arn.Resource, err error) invalidARNError {
-	return invalidARNError{
-		message:  "invalid ARN",
-		origErr:  err,
-		resource: resource,
-	}
-}
-
-func newInvalidARNWithCustomEndpointError(resource arn.Resource, err error) invalidARNError {
-	return invalidARNError{
-		message:  "resource ARN not supported with custom client endpoints",
-		origErr:  err,
-		resource: resource,
-	}
-}
-
-// ARN not supported for the target partition
-func newInvalidARNWithUnsupportedPartitionError(resource arn.Resource, err error) invalidARNError {
-	return invalidARNError{
-		message:  "resource ARN not supported for the target ARN partition",
-		origErr:  err,
-		resource: resource,
-	}
-}
-
-type configurationError struct {
-	message           string
-	resource          arn.Resource
-	clientPartitionID string
-	clientRegion      string
-	origErr           error
-}
-
-func (e configurationError) Error() string {
-	extra := fmt.Sprintf("ARN: %s, client partition: %s, client region: %s",
-		e.resource, e.clientPartitionID, e.clientRegion)
-
-	return awserr.SprintError(e.Code(), e.Message(), extra, e.origErr)
-}
-
-func (e configurationError) Code() string {
-	return configurationErrorErrCode
-}
-
-func (e configurationError) Message() string {
-	return e.message
-}
-
-func (e configurationError) OrigErr() error {
-	return e.origErr
-}
-
-func newClientPartitionMismatchError(resource arn.Resource, clientPartitionID, clientRegion string, err error) configurationError {
-	return configurationError{
-		message:           "client partition does not match provided ARN partition",
-		origErr:           err,
-		resource:          resource,
-		clientPartitionID: clientPartitionID,
-		clientRegion:      clientRegion,
-	}
-}
-
-func newClientRegionMismatchError(resource arn.Resource, clientPartitionID, clientRegion string, err error) configurationError {
-	return configurationError{
-		message:           "client region does not match provided ARN region",
-		origErr:           err,
-		resource:          resource,
-		clientPartitionID: clientPartitionID,
-		clientRegion:      clientRegion,
-	}
-}
-
-func newFailedToResolveEndpointError(resource arn.Resource, clientPartitionID, clientRegion string, err error) configurationError {
-	return configurationError{
-		message:           "endpoint resolver failed to find an endpoint for the provided ARN region",
-		origErr:           err,
-		resource:          resource,
-		clientPartitionID: clientPartitionID,
-		clientRegion:      clientRegion,
-	}
-}
-
-func newClientConfiguredForFIPSError(resource arn.Resource, clientPartitionID, clientRegion string, err error) configurationError {
-	return configurationError{
-		message:           "client configured for fips but cross-region resource ARN provided",
-		origErr:           err,
-		resource:          resource,
-		clientPartitionID: clientPartitionID,
-		clientRegion:      clientRegion,
-	}
-}
-
-func newClientConfiguredForAccelerateError(resource arn.Resource, clientPartitionID, clientRegion string, err error) configurationError {
-	return configurationError{
-		message:           "client configured for S3 Accelerate but is supported with resource ARN",
-		origErr:           err,
-		resource:          resource,
-		clientPartitionID: clientPartitionID,
-		clientRegion:      clientRegion,
-	}
-}
-
-func newClientConfiguredForCrossRegionFIPSError(resource arn.Resource, clientPartitionID, clientRegion string, err error) configurationError {
-	return configurationError{
-		message:           "client configured for FIPS with cross-region enabled but is supported with cross-region resource ARN",
-		origErr:           err,
-		resource:          resource,
-		clientPartitionID: clientPartitionID,
-		clientRegion:      clientRegion,
-	}
-}

vendor/github.com/aws/aws-sdk-go/service/s3/errors.go

@@ -13,12 +13,6 @@ const (
 
 	// ErrCodeBucketAlreadyOwnedByYou for service response error code
 	// "BucketAlreadyOwnedByYou".
-	//
-	// The bucket you tried to create already exists, and you own it. Amazon S3
-	// returns this error in all AWS Regions except in the North Virginia Region.
-	// For legacy compatibility, if you re-create an existing bucket that you already
-	// own in the North Virginia Region, Amazon S3 returns 200 OK and resets the
-	// bucket access control lists (ACLs).
 	ErrCodeBucketAlreadyOwnedByYou = "BucketAlreadyOwnedByYou"
 
 	// ErrCodeNoSuchBucket for service response error code
@@ -42,13 +36,13 @@ const (
 	// ErrCodeObjectAlreadyInActiveTierError for service response error code
 	// "ObjectAlreadyInActiveTierError".
 	//
-	// This operation is not allowed against this storage tier.
+	// This operation is not allowed against this storage tier
 	ErrCodeObjectAlreadyInActiveTierError = "ObjectAlreadyInActiveTierError"
 
 	// ErrCodeObjectNotInActiveTierError for service response error code
 	// "ObjectNotInActiveTierError".
 	//
 	// The source object of the COPY operation is not in the active tier and is
-	// only stored in Amazon S3 Glacier.
+	// only stored in Amazon Glacier.
 	ErrCodeObjectNotInActiveTierError = "ObjectNotInActiveTierError"
 )

vendor/github.com/aws/aws-sdk-go/service/s3/host_style_bucket.go

@@ -30,10 +30,10 @@ var accelerateOpBlacklist = operationBlacklist{
 	opListBuckets, opCreateBucket, opDeleteBucket,
 }
 
-// Automatically add the bucket name to the endpoint domain
+// Request handler to automatically add the bucket name to the endpoint domain
 // if possible. This style of bucket is valid for all bucket names which are
 // DNS compatible and do not contain "."
-func updateEndpointForS3Config(r *request.Request, bucketName string) {
+func updateEndpointForS3Config(r *request.Request) {
 	forceHostStyle := aws.BoolValue(r.Config.S3ForcePathStyle)
 	accelerate := aws.BoolValue(r.Config.S3UseAccelerate)
 
@@ -43,29 +43,45 @@ func updateEndpointForS3Config(r *request.Request, bucketName string) {
 				r.Config.Logger.Log("ERROR: aws.Config.S3UseAccelerate is not compatible with aws.Config.S3ForcePathStyle, ignoring S3ForcePathStyle.")
 			}
 		}
-		updateEndpointForAccelerate(r, bucketName)
+		updateEndpointForAccelerate(r)
 	} else if !forceHostStyle && r.Operation.Name != opGetBucketLocation {
-		updateEndpointForHostStyle(r, bucketName)
+		updateEndpointForHostStyle(r)
 	}
 }
 
-func updateEndpointForHostStyle(r *request.Request, bucketName string) {
-	if !hostCompatibleBucketName(r.HTTPRequest.URL, bucketName) {
+func updateEndpointForHostStyle(r *request.Request) {
+	bucket, ok := bucketNameFromReqParams(r.Params)
+	if !ok {
+		// Ignore operation requests if the bucketname was not provided
+		// if this is an input validation error the validation handler
+		// will report it.
+		return
+	}
+
+	if !hostCompatibleBucketName(r.HTTPRequest.URL, bucket) {
 		// bucket name must be valid to put into the host
 		return
 	}
 
-	moveBucketToHost(r.HTTPRequest.URL, bucketName)
+	moveBucketToHost(r.HTTPRequest.URL, bucket)
 }
 
 var (
 	accelElem = []byte("s3-accelerate.dualstack.")
 )
 
-func updateEndpointForAccelerate(r *request.Request, bucketName string) {
-	if !hostCompatibleBucketName(r.HTTPRequest.URL, bucketName) {
+func updateEndpointForAccelerate(r *request.Request) {
+	bucket, ok := bucketNameFromReqParams(r.Params)
+	if !ok {
+		// Ignore operation requests if the bucketname was not provided
+		// if this is an input validation error the validation handler
+		// will report it.
+		return
+	}
+
+	if !hostCompatibleBucketName(r.HTTPRequest.URL, bucket) {
 		r.Error = awserr.New("InvalidParameterException",
-			fmt.Sprintf("bucket name %s is not compatible with S3 Accelerate", bucketName),
+			fmt.Sprintf("bucket name %s is not compatible with S3 Accelerate", bucket),
 			nil)
 		return
 	}
@@ -90,7 +106,7 @@ func updateEndpointForAccelerate(r *request.Request, bucketName string) {
 
 	r.HTTPRequest.URL.Host = strings.Join(parts, ".")
 
-	moveBucketToHost(r.HTTPRequest.URL, bucketName)
+	moveBucketToHost(r.HTTPRequest.URL, bucket)
 }
 
 // Attempts to retrieve the bucket name from the request input parameters.
@@ -132,5 +148,8 @@ func dnsCompatibleBucketName(bucket string) bool {
 // moveBucketToHost moves the bucket name from the URI path to URL host.
 func moveBucketToHost(u *url.URL, bucket string) {
 	u.Host = bucket + "." + u.Host
-	removeBucketFromPath(u)
+	u.Path = strings.Replace(u.Path, "/{Bucket}", "", -1)
+	if u.Path == "" {
+		u.Path = "/"
+	}
 }

vendor/github.com/aws/aws-sdk-go/service/s3/internal/arn/accesspoint_arn.go

@@ -1,45 +0,0 @@
-package arn
-
-import (
-	"strings"
-
-	"github.com/aws/aws-sdk-go/aws/arn"
-)
-
-// AccessPointARN provides representation
-type AccessPointARN struct {
-	arn.ARN
-	AccessPointName string
-}
-
-// GetARN returns the base ARN for the Access Point resource
-func (a AccessPointARN) GetARN() arn.ARN {
-	return a.ARN
-}
-
-// ParseAccessPointResource attempts to parse the ARN's resource as an
-// AccessPoint resource.
-func ParseAccessPointResource(a arn.ARN, resParts []string) (AccessPointARN, error) {
-	if len(a.Region) == 0 {
-		return AccessPointARN{}, InvalidARNError{a, "region not set"}
-	}
-	if len(a.AccountID) == 0 {
-		return AccessPointARN{}, InvalidARNError{a, "account-id not set"}
-	}
-	if len(resParts) == 0 {
-		return AccessPointARN{}, InvalidARNError{a, "resource-id not set"}
-	}
-	if len(resParts) > 1 {
-		return AccessPointARN{}, InvalidARNError{a, "sub resource not supported"}
-	}
-
-	resID := resParts[0]
-	if len(strings.TrimSpace(resID)) == 0 {
-		return AccessPointARN{}, InvalidARNError{a, "resource-id not set"}
-	}
-
-	return AccessPointARN{
-		ARN:             a,
-		AccessPointName: resID,
-	}, nil
-}

vendor/github.com/aws/aws-sdk-go/service/s3/internal/arn/arn.go

@@ -1,71 +0,0 @@
-package arn
-
-import (
-	"strings"
-
-	"github.com/aws/aws-sdk-go/aws/arn"
-)
-
-// Resource provides the interfaces abstracting ARNs of specific resource
-// types.
-type Resource interface {
-	GetARN() arn.ARN
-	String() string
-}
-
-// ResourceParser provides the function for parsing an ARN's resource
-// component into a typed resource.
-type ResourceParser func(arn.ARN) (Resource, error)
-
-// ParseResource parses an AWS ARN into a typed resource for the S3 API.
-func ParseResource(s string, resParser ResourceParser) (resARN Resource, err error) {
-	a, err := arn.Parse(s)
-	if err != nil {
-		return nil, err
-	}
-
-	if len(a.Partition) == 0 {
-		return nil, InvalidARNError{a, "partition not set"}
-	}
-	if a.Service != "s3" {
-		return nil, InvalidARNError{a, "service is not S3"}
-	}
-	if len(a.Resource) == 0 {
-		return nil, InvalidARNError{a, "resource not set"}
-	}
-
-	return resParser(a)
-}
-
-// SplitResource splits the resource components by the ARN resource delimiters.
-func SplitResource(v string) []string {
-	var parts []string
-	var offset int
-
-	for offset <= len(v) {
-		idx := strings.IndexAny(v[offset:], "/:")
-		if idx < 0 {
-			parts = append(parts, v[offset:])
-			break
-		}
-		parts = append(parts, v[offset:idx+offset])
-		offset += idx + 1
-	}
-
-	return parts
-}
-
-// IsARN returns whether the given string is an ARN
-func IsARN(s string) bool {
-	return arn.IsARN(s)
-}
-
-// InvalidARNError provides the error for an invalid ARN error.
-type InvalidARNError struct {
-	ARN    arn.ARN
-	Reason string
-}
-
-func (e InvalidARNError) Error() string {
-	return "invalid Amazon S3 ARN, " + e.Reason + ", " + e.ARN.String()
-}

vendor/github.com/aws/aws-sdk-go/service/s3/s3manager/upload.go

@@ -397,18 +397,14 @@ func (u *uploader) init() error {
 		u.cfg.MaxUploadParts = MaxUploadParts
 	}
 
-	// Try to get the total size for some optimizations
-	if err := u.initSize(); err != nil {
-		return err
-	}
-
 	// If PartSize was changed or partPool was never setup then we need to allocated a new pool
 	// so that we return []byte slices of the correct size
 	if u.cfg.partPool == nil || u.cfg.partPool.partSize != u.cfg.PartSize {
 		u.cfg.partPool = newPartPool(u.cfg.PartSize)
 	}
 
-	return nil
+	// Try to get the total size for some optimizations
+	return u.initSize()
 }
 
 // initSize tries to detect the total stream size, setting u.totalSize. If

vendor/github.com/aws/aws-sdk-go/service/s3/s3manager/upload_input.go

@@ -14,57 +14,40 @@ import (
 type UploadInput struct {
 	_ struct{} `locationName:"PutObjectRequest" type:"structure" payload:"Body"`
 
-	// The canned ACL to apply to the object. For more information, see Canned ACL
-	// (https://docs.aws.amazon.com/AmazonS3/latest/dev/acl-overview.html#CannedACL).
+	// The canned ACL to apply to the object.
 	ACL *string `location:"header" locationName:"x-amz-acl" type:"string" enum:"ObjectCannedACL"`
 
 	// The readable body payload to send to S3.
 	Body io.Reader
 
-	// Bucket name to which the PUT operation was initiated.
-	//
-	// When using this API with an access point, you must direct requests to the
-	// access point hostname. The access point hostname takes the form AccessPointName-AccountId.s3-accesspoint.Region.amazonaws.com.
-	// When using this operation using an access point through the AWS SDKs, you
-	// provide the access point ARN in place of the bucket name. For more information
-	// about access point ARNs, see Using Access Points (https://docs.aws.amazon.com/AmazonS3/latest/dev/using-access-points.html)
-	// in the Amazon Simple Storage Service Developer Guide.
+	// Name of the bucket to which the PUT operation was initiated.
 	//
 	// Bucket is a required field
 	Bucket *string `location:"uri" locationName:"Bucket" type:"string" required:"true"`
 
-	// Can be used to specify caching behavior along the request/reply chain. For
-	// more information, see http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9
-	// (http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9).
+	// Specifies caching behavior along the request/reply chain.
 	CacheControl *string `location:"header" locationName:"Cache-Control" type:"string"`
 
-	// Specifies presentational information for the object. For more information,
-	// see http://www.w3.org/Protocols/rfc2616/rfc2616-sec19.html#sec19.5.1 (http://www.w3.org/Protocols/rfc2616/rfc2616-sec19.html#sec19.5.1).
+	// Specifies presentational information for the object.
 	ContentDisposition *string `location:"header" locationName:"Content-Disposition" type:"string"`
 
 	// Specifies what content encodings have been applied to the object and thus
 	// what decoding mechanisms must be applied to obtain the media-type referenced
-	// by the Content-Type header field. For more information, see http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.11
-	// (http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.11).
+	// by the Content-Type header field.
 	ContentEncoding *string `location:"header" locationName:"Content-Encoding" type:"string"`
 
 	// The language the content is in.
 	ContentLanguage *string `location:"header" locationName:"Content-Language" type:"string"`
 
-	// The base64-encoded 128-bit MD5 digest of the message (without the headers)
-	// according to RFC 1864. This header can be used as a message integrity check
-	// to verify that the data is the same data that was originally sent. Although
-	// it is optional, we recommend using the Content-MD5 mechanism as an end-to-end
-	// integrity check. For more information about REST request authentication,
-	// see REST Authentication (https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html).
+	// The base64-encoded 128-bit MD5 digest of the part data. This parameter is
+	// auto-populated when using the command from the CLI. This parameted is required
+	// if object lock parameters are specified.
 	ContentMD5 *string `location:"header" locationName:"Content-MD5" type:"string"`
 
-	// A standard MIME type describing the format of the contents. For more information,
-	// see http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.17 (http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.17).
+	// A standard MIME type describing the format of the object data.
 	ContentType *string `location:"header" locationName:"Content-Type" type:"string"`
 
-	// The date and time at which the object is no longer cacheable. For more information,
-	// see http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.21 (http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.21).
+	// The date and time at which the object is no longer cacheable.
 	Expires *time.Time `location:"header" locationName:"Expires" type:"timestamp"`
 
 	// Gives the grantee READ, READ_ACP, and WRITE_ACP permissions on the object.
@@ -87,37 +70,34 @@ type UploadInput struct {
 	// A map of metadata to store with the object in S3.
 	Metadata map[string]*string `location:"headers" locationName:"x-amz-meta-" type:"map"`
 
-	// Specifies whether a legal hold will be applied to this object. For more information
-	// about S3 Object Lock, see Object Lock (https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock.html).
+	// The Legal Hold status that you want to apply to the specified object.
 	ObjectLockLegalHoldStatus *string `location:"header" locationName:"x-amz-object-lock-legal-hold" type:"string" enum:"ObjectLockLegalHoldStatus"`
 
-	// The Object Lock mode that you want to apply to this object.
+	// The object lock mode that you want to apply to this object.
 	ObjectLockMode *string `location:"header" locationName:"x-amz-object-lock-mode" type:"string" enum:"ObjectLockMode"`
 
-	// The date and time when you want this object's Object Lock to expire.
+	// The date and time when you want this object's object lock to expire.
 	ObjectLockRetainUntilDate *time.Time `location:"header" locationName:"x-amz-object-lock-retain-until-date" type:"timestamp" timestampFormat:"iso8601"`
 
-	// Confirms that the requester knows that they will be charged for the request.
-	// Bucket owners need not specify this parameter in their requests. For information
-	// about downloading objects from requester pays buckets, see Downloading Objects
-	// in Requestor Pays Buckets (https://docs.aws.amazon.com/AmazonS3/latest/dev/ObjectsinRequesterPaysBuckets.html)
-	// in the Amazon S3 Developer Guide.
+	// Confirms that the requester knows that she or he will be charged for the
+	// request. Bucket owners need not specify this parameter in their requests.
+	// Documentation on downloading objects from requester pays buckets can be found
+	// at http://docs.aws.amazon.com/AmazonS3/latest/dev/ObjectsinRequesterPaysBuckets.html
 	RequestPayer *string `location:"header" locationName:"x-amz-request-payer" type:"string" enum:"RequestPayer"`
 
-	// Specifies the algorithm to use to when encrypting the object (for example,
-	// AES256).
+	// Specifies the algorithm to use to when encrypting the object (e.g., AES256).
 	SSECustomerAlgorithm *string `location:"header" locationName:"x-amz-server-side-encryption-customer-algorithm" type:"string"`
 
 	// Specifies the customer-provided encryption key for Amazon S3 to use in encrypting
 	// data. This value is used to store the object and then it is discarded; Amazon
-	// S3 does not store the encryption key. The key must be appropriate for use
-	// with the algorithm specified in the x-amz-server-side​-encryption​-customer-algorithm
+	// does not store the encryption key. The key must be appropriate for use with
+	// the algorithm specified in the x-amz-server-side​-encryption​-customer-algorithm
 	// header.
 	SSECustomerKey *string `marshal-as:"blob" location:"header" locationName:"x-amz-server-side-encryption-customer-key" type:"string" sensitive:"true"`
 
 	// Specifies the 128-bit MD5 digest of the encryption key according to RFC 1321.
-	// Amazon S3 uses this header for a message integrity check to ensure that the
-	// encryption key was transmitted without error.
+	// Amazon S3 uses this header for a message integrity check to ensure the encryption
+	// key was transmitted without error.
 	SSECustomerKeyMD5 *string `location:"header" locationName:"x-amz-server-side-encryption-customer-key-MD5" type:"string"`
 
 	// Specifies the AWS KMS Encryption Context to use for object encryption. The
@@ -125,24 +105,17 @@ type UploadInput struct {
 	// encryption context key-value pairs.
 	SSEKMSEncryptionContext *string `location:"header" locationName:"x-amz-server-side-encryption-context" type:"string" sensitive:"true"`
 
-	// If x-amz-server-side-encryption is present and has the value of aws:kms,
-	// this header specifies the ID of the AWS Key Management Service (AWS KMS)
-	// symmetrical customer managed customer master key (CMK) that was used for
-	// the object.
-	//
-	// If the value of x-amz-server-side-encryption is aws:kms, this header specifies
-	// the ID of the symmetric customer managed AWS KMS CMK that will be used for
-	// the object. If you specify x-amz-server-side-encryption:aws:kms, but do not
-	// providex-amz-server-side-encryption-aws-kms-key-id, Amazon S3 uses the AWS
-	// managed CMK in AWS to protect the data.
+	// Specifies the AWS KMS key ID to use for object encryption. All GET and PUT
+	// requests for an object protected by AWS KMS will fail if not made via SSL
+	// or using SigV4. Documentation on configuring any of the officially supported
+	// AWS SDKs and CLI can be found at http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingAWSSDK.html#specify-signature-version
 	SSEKMSKeyId *string `location:"header" locationName:"x-amz-server-side-encryption-aws-kms-key-id" type:"string" sensitive:"true"`
 
-	// The server-side encryption algorithm used when storing this object in Amazon
-	// S3 (for example, AES256, aws:kms).
+	// The Server-side encryption algorithm used when storing this object in S3
+	// (e.g., AES256, aws:kms).
 	ServerSideEncryption *string `location:"header" locationName:"x-amz-server-side-encryption" type:"string" enum:"ServerSideEncryption"`
 
-	// If you don't specify, Standard is the default storage class. Amazon S3 supports
-	// other storage classes.
+	// The type of storage to use for the object. Defaults to 'STANDARD'.
 	StorageClass *string `location:"header" locationName:"x-amz-storage-class" type:"string" enum:"StorageClass"`
 
 	// The tag-set for the object. The tag-set must be encoded as URL Query parameters.
@@ -151,21 +124,6 @@ type UploadInput struct {
 
 	// If the bucket is configured as a website, redirects requests for this object
 	// to another object in the same bucket or to an external URL. Amazon S3 stores
-	// the value of this header in the object metadata. For information about object
-	// metadata, see Object Key and Metadata (https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingMetadata.html).
-	//
-	// In the following example, the request header sets the redirect to an object
-	// (anotherPage.html) in the same bucket:
-	//
-	// x-amz-website-redirect-location: /anotherPage.html
-	//
-	// In the following example, the request header sets the object redirect to
-	// another website:
-	//
-	// x-amz-website-redirect-location: http://www.example.com/
-	//
-	// For more information about website hosting in Amazon S3, see Hosting Websites
-	// on Amazon S3 (https://docs.aws.amazon.com/AmazonS3/latest/dev/WebsiteHosting.html)
-	// and How to Configure Website Page Redirects (https://docs.aws.amazon.com/AmazonS3/latest/dev/how-to-page-redirect.html).
+	// the value of this header in the object metadata.
 	WebsiteRedirectLocation *string `location:"header" locationName:"x-amz-website-redirect-location" type:"string"`
 }

vendor/github.com/aws/aws-sdk-go/service/s3/service.go

@@ -31,7 +31,7 @@ var initRequest func(*request.Request)
 const (
 	ServiceName = "s3"        // Name of service.
 	EndpointsID = ServiceName // ID to lookup a service endpoint with.
-	ServiceID   = "S3"        // ServiceID is a unique identifier of a specific service.
+	ServiceID   = "S3"        // ServiceID is a unique identifer of a specific service.
 )
 
 // New creates a new instance of the S3 client with a session.
@@ -39,8 +39,6 @@ const (
 // aws.Config parameter to add your extra config.
 //
 // Example:
-//     mySession := session.Must(session.NewSession())
-//
 //     // Create a S3 client from just a session.
 //     svc := s3.New(mySession)
 //
@@ -48,11 +46,11 @@ const (
 //     svc := s3.New(mySession, aws.NewConfig().WithRegion("us-west-2"))
 func New(p client.ConfigProvider, cfgs ...*aws.Config) *S3 {
 	c := p.ClientConfig(EndpointsID, cfgs...)
-	return newClient(*c.Config, c.Handlers, c.PartitionID, c.Endpoint, c.SigningRegion, c.SigningName)
+	return newClient(*c.Config, c.Handlers, c.Endpoint, c.SigningRegion, c.SigningName)
 }
 
 // newClient creates, initializes and returns a new service client instance.
-func newClient(cfg aws.Config, handlers request.Handlers, partitionID, endpoint, signingRegion, signingName string) *S3 {
+func newClient(cfg aws.Config, handlers request.Handlers, endpoint, signingRegion, signingName string) *S3 {
 	svc := &S3{
 		Client: client.New(
 			cfg,
@@ -61,7 +59,6 @@ func newClient(cfg aws.Config, handlers request.Handlers, partitionID, endpoint,
 				ServiceID:     ServiceID,
 				SigningName:   signingName,
 				SigningRegion: signingRegion,
-				PartitionID:   partitionID,
 				Endpoint:      endpoint,
 				APIVersion:    "2006-03-01",
 			},
@@ -78,7 +75,6 @@ func newClient(cfg aws.Config, handlers request.Handlers, partitionID, endpoint,
 	svc.Handlers.UnmarshalMeta.PushBackNamed(restxml.UnmarshalMetaHandler)
 	svc.Handlers.UnmarshalError.PushBackNamed(restxml.UnmarshalErrorHandler)
 
-	svc.Handlers.BuildStream.PushBackNamed(restxml.BuildHandler)
 	svc.Handlers.UnmarshalStream.PushBackNamed(restxml.UnmarshalHandler)
 
 	// Run custom client initialization if present

vendor/github.com/aws/aws-sdk-go/service/sts/api.go

@@ -78,8 +78,6 @@ func (c *STS) AssumeRoleRequest(input *AssumeRoleInput) (req *request.Request, o
 // IAM Roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html)
 // in the IAM User Guide.
 //
-// Session Duration
-//
 // By default, the temporary security credentials created by AssumeRole last
 // for one hour. However, you can use the optional DurationSeconds parameter
 // to specify the duration of your session. You can provide a value from 900
@@ -93,8 +91,6 @@ func (c *STS) AssumeRoleRequest(input *AssumeRoleInput) (req *request.Request, o
 // URL. For more information, see Using IAM Roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html)
 // in the IAM User Guide.
 //
-// Permissions
-//
 // The temporary security credentials created by AssumeRole can be used to make
 // API calls to any AWS service with the following exception: You cannot call
 // the AWS STS GetFederationToken or GetSessionToken API operations.
@@ -103,7 +99,7 @@ func (c *STS) AssumeRoleRequest(input *AssumeRoleInput) (req *request.Request, o
 // to this operation. You can pass a single JSON policy document to use as an
 // inline session policy. You can also specify up to 10 managed policies to
 // use as managed session policies. The plain text that you use for both inline
-// and managed session policies can't exceed 2,048 characters. Passing policies
+// and managed session policies shouldn't exceed 2048 characters. Passing policies
 // to this operation returns new temporary credentials. The resulting session's
 // permissions are the intersection of the role's identity-based policy and
 // the session policies. You can use the role's temporary credentials in subsequent
@@ -135,24 +131,6 @@ func (c *STS) AssumeRoleRequest(input *AssumeRoleInput) (req *request.Request, o
 // see IAM Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html)
 // in the IAM User Guide.
 //
-// Tags
-//
-// (Optional) You can pass tag key-value pairs to your session. These tags are
-// called session tags. For more information about session tags, see Passing
-// Session Tags in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
-// in the IAM User Guide.
-//
-// An administrator must grant you the permissions necessary to pass session
-// tags. The administrator can also create granular permissions to allow you
-// to pass only specific session tags. For more information, see Tutorial: Using
-// Tags for Attribute-Based Access Control (https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html)
-// in the IAM User Guide.
-//
-// You can set the session tags as transitive. Transitive tags persist during
-// role chaining. For more information, see Chaining Roles with Session Tags
-// (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining)
-// in the IAM User Guide.
-//
 // Using MFA with AssumeRole
 //
 // (Optional) You can include multi-factor authentication (MFA) information
@@ -187,18 +165,9 @@ func (c *STS) AssumeRoleRequest(input *AssumeRoleInput) (req *request.Request, o
 //   message describes the specific error.
 //
 //   * ErrCodePackedPolicyTooLargeException "PackedPolicyTooLarge"
-//   The request was rejected because the total packed size of the session policies
-//   and session tags combined was too large. An AWS conversion compresses the
-//   session policy document, session policy ARNs, and session tags into a packed
-//   binary format that has a separate limit. The error message indicates by percentage
-//   how close the policies and tags are to the upper size limit. For more information,
-//   see Passing Session Tags in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
-//   in the IAM User Guide.
-//
-//   You could receive this error even though you meet other defined session policy
-//   and session tag limits. For more information, see IAM and STS Entity Character
-//   Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html)
-//   in the IAM User Guide.
+//   The request was rejected because the policy document was too large. The error
+//   message describes how big the policy document is, in packed form, as a percentage
+//   of what the API allows.
 //
 //   * ErrCodeRegionDisabledException "RegionDisabledException"
 //   STS is not activated in the requested region for the account that is being
@@ -287,8 +256,6 @@ func (c *STS) AssumeRoleWithSAMLRequest(input *AssumeRoleWithSAMLInput) (req *re
 // an access key ID, a secret access key, and a security token. Applications
 // can use these temporary security credentials to sign calls to AWS services.
 //
-// Session Duration
-//
 // By default, the temporary security credentials created by AssumeRoleWithSAML
 // last for one hour. However, you can use the optional DurationSeconds parameter
 // to specify the duration of your session. Your role session lasts for the
@@ -304,8 +271,6 @@ func (c *STS) AssumeRoleWithSAMLRequest(input *AssumeRoleWithSAMLInput) (req *re
 // URL. For more information, see Using IAM Roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html)
 // in the IAM User Guide.
 //
-// Permissions
-//
 // The temporary security credentials created by AssumeRoleWithSAML can be used
 // to make API calls to any AWS service with the following exception: you cannot
 // call the STS GetFederationToken or GetSessionToken API operations.
@@ -314,7 +279,7 @@ func (c *STS) AssumeRoleWithSAMLRequest(input *AssumeRoleWithSAMLInput) (req *re
 // to this operation. You can pass a single JSON policy document to use as an
 // inline session policy. You can also specify up to 10 managed policies to
 // use as managed session policies. The plain text that you use for both inline
-// and managed session policies can't exceed 2,048 characters. Passing policies
+// and managed session policies shouldn't exceed 2048 characters. Passing policies
 // to this operation returns new temporary credentials. The resulting session's
 // permissions are the intersection of the role's identity-based policy and
 // the session policies. You can use the role's temporary credentials in subsequent
@@ -324,6 +289,12 @@ func (c *STS) AssumeRoleWithSAMLRequest(input *AssumeRoleWithSAMLInput) (req *re
 // information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
 // in the IAM User Guide.
 //
+// Before your application can call AssumeRoleWithSAML, you must configure your
+// SAML identity provider (IdP) to issue the claims required by AWS. Additionally,
+// you must use AWS Identity and Access Management (IAM) to create a SAML provider
+// entity in your AWS account that represents your identity provider. You must
+// also create an IAM role that specifies this SAML provider in its trust policy.
+//
 // Calling AssumeRoleWithSAML does not require the use of AWS security credentials.
 // The identity of the caller is validated by using keys in the metadata document
 // that is uploaded for the SAML provider entity for your identity provider.
@@ -331,50 +302,8 @@ func (c *STS) AssumeRoleWithSAMLRequest(input *AssumeRoleWithSAMLInput) (req *re
 // Calling AssumeRoleWithSAML can result in an entry in your AWS CloudTrail
 // logs. The entry includes the value in the NameID element of the SAML assertion.
 // We recommend that you use a NameIDType that is not associated with any personally
-// identifiable information (PII). For example, you could instead use the persistent
-// identifier (urn:oasis:names:tc:SAML:2.0:nameid-format:persistent).
-//
-// Tags
-//
-// (Optional) You can configure your IdP to pass attributes into your SAML assertion
-// as session tags. Each session tag consists of a key name and an associated
-// value. For more information about session tags, see Passing Session Tags
-// in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
-// in the IAM User Guide.
-//
-// You can pass up to 50 session tags. The plain text session tag keys can’t
-// exceed 128 characters and the values can’t exceed 256 characters. For these
-// and additional limits, see IAM and STS Character Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length)
-// in the IAM User Guide.
-//
-// An AWS conversion compresses the passed session policies and session tags
-// into a packed binary format that has a separate limit. Your request can fail
-// for this limit even if your plain text meets the other requirements. The
-// PackedPolicySize response element indicates by percentage how close the policies
-// and tags for your request are to the upper size limit.
-//
-// You can pass a session tag with the same key as a tag that is attached to
-// the role. When you do, session tags override the role's tags with the same
-// key.
-//
-// An administrator must grant you the permissions necessary to pass session
-// tags. The administrator can also create granular permissions to allow you
-// to pass only specific session tags. For more information, see Tutorial: Using
-// Tags for Attribute-Based Access Control (https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html)
-// in the IAM User Guide.
-//
-// You can set the session tags as transitive. Transitive tags persist during
-// role chaining. For more information, see Chaining Roles with Session Tags
-// (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining)
-// in the IAM User Guide.
-//
-// SAML Configuration
-//
-// Before your application can call AssumeRoleWithSAML, you must configure your
-// SAML identity provider (IdP) to issue the claims required by AWS. Additionally,
-// you must use AWS Identity and Access Management (IAM) to create a SAML provider
-// entity in your AWS account that represents your identity provider. You must
-// also create an IAM role that specifies this SAML provider in its trust policy.
+// identifiable information (PII). For example, you could instead use the Persistent
+// Identifier (urn:oasis:names:tc:SAML:2.0:nameid-format:persistent).
 //
 // For more information, see the following resources:
 //
@@ -403,18 +332,9 @@ func (c *STS) AssumeRoleWithSAMLRequest(input *AssumeRoleWithSAMLInput) (req *re
 //   message describes the specific error.
 //
 //   * ErrCodePackedPolicyTooLargeException "PackedPolicyTooLarge"
-//   The request was rejected because the total packed size of the session policies
-//   and session tags combined was too large. An AWS conversion compresses the
-//   session policy document, session policy ARNs, and session tags into a packed
-//   binary format that has a separate limit. The error message indicates by percentage
-//   how close the policies and tags are to the upper size limit. For more information,
-//   see Passing Session Tags in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
-//   in the IAM User Guide.
-//
-//   You could receive this error even though you meet other defined session policy
-//   and session tag limits. For more information, see IAM and STS Entity Character
-//   Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html)
-//   in the IAM User Guide.
+//   The request was rejected because the policy document was too large. The error
+//   message describes how big the policy document is, in packed form, as a percentage
+//   of what the API allows.
 //
 //   * ErrCodeIDPRejectedClaimException "IDPRejectedClaim"
 //   The identity provider (IdP) reported that authentication failed. This might
@@ -536,8 +456,6 @@ func (c *STS) AssumeRoleWithWebIdentityRequest(input *AssumeRoleWithWebIdentityI
 // key ID, a secret access key, and a security token. Applications can use these
 // temporary security credentials to sign calls to AWS service API operations.
 //
-// Session Duration
-//
 // By default, the temporary security credentials created by AssumeRoleWithWebIdentity
 // last for one hour. However, you can use the optional DurationSeconds parameter
 // to specify the duration of your session. You can provide a value from 900
@@ -551,8 +469,6 @@ func (c *STS) AssumeRoleWithWebIdentityRequest(input *AssumeRoleWithWebIdentityI
 // URL. For more information, see Using IAM Roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html)
 // in the IAM User Guide.
 //
-// Permissions
-//
 // The temporary security credentials created by AssumeRoleWithWebIdentity can
 // be used to make API calls to any AWS service with the following exception:
 // you cannot call the STS GetFederationToken or GetSessionToken API operations.
@@ -561,7 +477,7 @@ func (c *STS) AssumeRoleWithWebIdentityRequest(input *AssumeRoleWithWebIdentityI
 // to this operation. You can pass a single JSON policy document to use as an
 // inline session policy. You can also specify up to 10 managed policies to
 // use as managed session policies. The plain text that you use for both inline
-// and managed session policies can't exceed 2,048 characters. Passing policies
+// and managed session policies shouldn't exceed 2048 characters. Passing policies
 // to this operation returns new temporary credentials. The resulting session's
 // permissions are the intersection of the role's identity-based policy and
 // the session policies. You can use the role's temporary credentials in subsequent
@@ -571,42 +487,6 @@ func (c *STS) AssumeRoleWithWebIdentityRequest(input *AssumeRoleWithWebIdentityI
 // information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
 // in the IAM User Guide.
 //
-// Tags
-//
-// (Optional) You can configure your IdP to pass attributes into your web identity
-// token as session tags. Each session tag consists of a key name and an associated
-// value. For more information about session tags, see Passing Session Tags
-// in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
-// in the IAM User Guide.
-//
-// You can pass up to 50 session tags. The plain text session tag keys can’t
-// exceed 128 characters and the values can’t exceed 256 characters. For these
-// and additional limits, see IAM and STS Character Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length)
-// in the IAM User Guide.
-//
-// An AWS conversion compresses the passed session policies and session tags
-// into a packed binary format that has a separate limit. Your request can fail
-// for this limit even if your plain text meets the other requirements. The
-// PackedPolicySize response element indicates by percentage how close the policies
-// and tags for your request are to the upper size limit.
-//
-// You can pass a session tag with the same key as a tag that is attached to
-// the role. When you do, the session tag overrides the role tag with the same
-// key.
-//
-// An administrator must grant you the permissions necessary to pass session
-// tags. The administrator can also create granular permissions to allow you
-// to pass only specific session tags. For more information, see Tutorial: Using
-// Tags for Attribute-Based Access Control (https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html)
-// in the IAM User Guide.
-//
-// You can set the session tags as transitive. Transitive tags persist during
-// role chaining. For more information, see Chaining Roles with Session Tags
-// (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining)
-// in the IAM User Guide.
-//
-// Identities
-//
 // Before your application can call AssumeRoleWithWebIdentity, you must have
 // an identity token from a supported identity provider and create a role that
 // the application can assume. The role that your application assumes must trust
@@ -634,8 +514,8 @@ func (c *STS) AssumeRoleWithWebIdentityRequest(input *AssumeRoleWithWebIdentityI
 //    * AWS SDK for iOS Developer Guide (http://aws.amazon.com/sdkforios/) and
 //    AWS SDK for Android Developer Guide (http://aws.amazon.com/sdkforandroid/).
 //    These toolkits contain sample apps that show how to invoke the identity
-//    providers. The toolkits then show how to use the information from these
-//    providers to get and use temporary security credentials.
+//    providers, and then how to use the information from these providers to
+//    get and use temporary security credentials.
 //
 //    * Web Identity Federation with Mobile Applications (http://aws.amazon.com/articles/web-identity-federation-with-mobile-applications).
 //    This article discusses web identity federation and shows an example of
@@ -655,18 +535,9 @@ func (c *STS) AssumeRoleWithWebIdentityRequest(input *AssumeRoleWithWebIdentityI
 //   message describes the specific error.
 //
 //   * ErrCodePackedPolicyTooLargeException "PackedPolicyTooLarge"
-//   The request was rejected because the total packed size of the session policies
-//   and session tags combined was too large. An AWS conversion compresses the
-//   session policy document, session policy ARNs, and session tags into a packed
-//   binary format that has a separate limit. The error message indicates by percentage
-//   how close the policies and tags are to the upper size limit. For more information,
-//   see Passing Session Tags in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
-//   in the IAM User Guide.
-//
-//   You could receive this error even though you meet other defined session policy
-//   and session tag limits. For more information, see IAM and STS Entity Character
-//   Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html)
-//   in the IAM User Guide.
+//   The request was rejected because the policy document was too large. The error
+//   message describes how big the policy document is, in packed form, as a percentage
+//   of what the API allows.
 //
 //   * ErrCodeIDPRejectedClaimException "IDPRejectedClaim"
 //   The identity provider (IdP) reported that authentication failed. This might
@@ -676,11 +547,11 @@ func (c *STS) AssumeRoleWithWebIdentityRequest(input *AssumeRoleWithWebIdentityI
 //   can also mean that the claim has expired or has been explicitly revoked.
 //
 //   * ErrCodeIDPCommunicationErrorException "IDPCommunicationError"
-//   The request could not be fulfilled because the identity provider (IDP) that
-//   was asked to verify the incoming identity token could not be reached. This
-//   is often a transient error caused by network conditions. Retry the request
+//   The request could not be fulfilled because the non-AWS identity provider
+//   (IDP) that was asked to verify the incoming identity token could not be reached.
+//   This is often a transient error caused by network conditions. Retry the request
 //   a limited number of times so that you don't exceed the request rate. If the
-//   error persists, the identity provider might be down or not responding.
+//   error persists, the non-AWS identity provider might be down or not responding.
 //
 //   * ErrCodeInvalidIdentityTokenException "InvalidIdentityToken"
 //   The web identity token that was passed could not be validated by AWS. Get
@@ -805,9 +676,9 @@ func (c *STS) DecodeAuthorizationMessageRequest(input *DecodeAuthorizationMessag
 //
 // Returned Error Codes:
 //   * ErrCodeInvalidAuthorizationMessageException "InvalidAuthorizationMessageException"
-//   The error returned if the message passed to DecodeAuthorizationMessage was
-//   invalid. This can happen if the token contains invalid characters, such as
-//   linebreaks.
+//   This error is returned if the message passed to DecodeAuthorizationMessage
+//   was invalid. This can happen if the token contains invalid characters, such
+//   as linebreaks.
 //
 // See also, https://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/DecodeAuthorizationMessage
 func (c *STS) DecodeAuthorizationMessage(input *DecodeAuthorizationMessageInput) (*DecodeAuthorizationMessageOutput, error) {
@@ -892,8 +763,7 @@ func (c *STS) GetAccessKeyInfoRequest(input *GetAccessKeyInfoInput) (req *reques
 // pull a credentials report (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html)
 // to learn which IAM user owns the keys. To learn who requested the temporary
 // credentials for an ASIA access key, view the STS events in your CloudTrail
-// logs (https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html)
-// in the IAM User Guide.
+// logs (https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html).
 //
 // This operation does not indicate the state of the access key. The key might
 // be active, inactive, or deleted. Active keys might not have permissions to
@@ -980,8 +850,7 @@ func (c *STS) GetCallerIdentityRequest(input *GetCallerIdentityInput) (req *requ
 // sts:GetCallerIdentity action, you can still perform this operation. Permissions
 // are not required because the same information is returned when an IAM user
 // or role is denied access. To view an example response, see I Am Not Authorized
-// to Perform: iam:DeleteVirtualMFADevice (https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_access-denied-delete-mfa)
-// in the IAM User Guide.
+// to Perform: iam:DeleteVirtualMFADevice (https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_access-denied-delete-mfa).
 //
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
@@ -1073,8 +942,7 @@ func (c *STS) GetFederationTokenRequest(input *GetFederationTokenInput) (req *re
 // or an OpenID Connect-compatible identity provider. In this case, we recommend
 // that you use Amazon Cognito (http://aws.amazon.com/cognito/) or AssumeRoleWithWebIdentity.
 // For more information, see Federation Through a Web-based Identity Provider
-// (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity)
-// in the IAM User Guide.
+// (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity).
 //
 // You can also call GetFederationToken using the security credentials of an
 // AWS account root user, but we do not recommend it. Instead, we recommend
@@ -1084,67 +952,41 @@ func (c *STS) GetFederationTokenRequest(input *GetFederationTokenInput) (req *re
 // Practices (https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html)
 // in the IAM User Guide.
 //
-// Session duration
-//
 // The temporary credentials are valid for the specified duration, from 900
 // seconds (15 minutes) up to a maximum of 129,600 seconds (36 hours). The default
-// session duration is 43,200 seconds (12 hours). Temporary credentials that
-// are obtained by using AWS account root user credentials have a maximum duration
-// of 3,600 seconds (1 hour).
+// is 43,200 seconds (12 hours). Temporary credentials that are obtained by
+// using AWS account root user credentials have a maximum duration of 3,600
+// seconds (1 hour).
+//
+// The temporary security credentials created by GetFederationToken can be used
+// to make API calls to any AWS service with the following exceptions:
+//
+//    * You cannot use these credentials to call any IAM API operations.
+//
+//    * You cannot call any STS API operations except GetCallerIdentity.
 //
 // Permissions
 //
-// You can use the temporary credentials created by GetFederationToken in any
-// AWS service except the following:
-//
-//    * You cannot call any IAM operations using the AWS CLI or the AWS API.
-//
-//    * You cannot call any STS operations except GetCallerIdentity.
-//
 // You must pass an inline or managed session policy (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
 // to this operation. You can pass a single JSON policy document to use as an
 // inline session policy. You can also specify up to 10 managed policies to
 // use as managed session policies. The plain text that you use for both inline
-// and managed session policies can't exceed 2,048 characters.
+// and managed session policies shouldn't exceed 2048 characters.
 //
 // Though the session policy parameters are optional, if you do not pass a policy,
-// then the resulting federated user session has no permissions. When you pass
-// session policies, the session permissions are the intersection of the IAM
-// user policies and the session policies that you pass. This gives you a way
-// to further restrict the permissions for a federated user. You cannot use
-// session policies to grant more permissions than those that are defined in
-// the permissions policy of the IAM user. For more information, see Session
-// Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
+// then the resulting federated user session has no permissions. The only exception
+// is when the credentials are used to access a resource that has a resource-based
+// policy that specifically references the federated user session in the Principal
+// element of the policy. When you pass session policies, the session permissions
+// are the intersection of the IAM user policies and the session policies that
+// you pass. This gives you a way to further restrict the permissions for a
+// federated user. You cannot use session policies to grant more permissions
+// than those that are defined in the permissions policy of the IAM user. For
+// more information, see Session Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
 // in the IAM User Guide. For information about using GetFederationToken to
 // create temporary security credentials, see GetFederationToken—Federation
 // Through a Custom Identity Broker (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getfederationtoken).
 //
-// You can use the credentials to access a resource that has a resource-based
-// policy. If that policy specifically references the federated user session
-// in the Principal element of the policy, the session has the permissions allowed
-// by the policy. These permissions are granted in addition to the permissions
-// granted by the session policies.
-//
-// Tags
-//
-// (Optional) You can pass tag key-value pairs to your session. These are called
-// session tags. For more information about session tags, see Passing Session
-// Tags in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
-// in the IAM User Guide.
-//
-// An administrator must grant you the permissions necessary to pass session
-// tags. The administrator can also create granular permissions to allow you
-// to pass only specific session tags. For more information, see Tutorial: Using
-// Tags for Attribute-Based Access Control (https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html)
-// in the IAM User Guide.
-//
-// Tag key–value pairs are not case sensitive, but case is preserved. This
-// means that you cannot have separate Department and department tag keys. Assume
-// that the user that you are federating has the Department=Marketing tag and
-// you pass the department=engineering session tag. Department and department
-// are not saved as separate tags, and the session tag passed in the request
-// takes precedence over the user tag.
-//
 // Returns awserr.Error for service API and SDK errors. Use runtime type assertions
 // with awserr.Error's Code and Message methods to get detailed information about
 // the error.
@@ -1158,18 +1000,9 @@ func (c *STS) GetFederationTokenRequest(input *GetFederationTokenInput) (req *re
 //   message describes the specific error.
 //
 //   * ErrCodePackedPolicyTooLargeException "PackedPolicyTooLarge"
-//   The request was rejected because the total packed size of the session policies
-//   and session tags combined was too large. An AWS conversion compresses the
-//   session policy document, session policy ARNs, and session tags into a packed
-//   binary format that has a separate limit. The error message indicates by percentage
-//   how close the policies and tags are to the upper size limit. For more information,
-//   see Passing Session Tags in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
-//   in the IAM User Guide.
-//
-//   You could receive this error even though you meet other defined session policy
-//   and session tag limits. For more information, see IAM and STS Entity Character
-//   Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html)
-//   in the IAM User Guide.
+//   The request was rejected because the policy document was too large. The error
+//   message describes how big the policy document is, in packed form, as a percentage
+//   of what the API allows.
 //
 //   * ErrCodeRegionDisabledException "RegionDisabledException"
 //   STS is not activated in the requested region for the account that is being
@@ -1258,8 +1091,6 @@ func (c *STS) GetSessionTokenRequest(input *GetSessionTokenInput) (req *request.
 // and Comparing the AWS STS API operations (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison)
 // in the IAM User Guide.
 //
-// Session Duration
-//
 // The GetSessionToken operation must be called by using the long-term AWS security
 // credentials of the AWS account root user or an IAM user. Credentials that
 // are created by IAM users are valid for the duration that you specify. This
@@ -1268,8 +1099,6 @@ func (c *STS) GetSessionTokenRequest(input *GetSessionTokenInput) (req *request.
 // based on account credentials can range from 900 seconds (15 minutes) up to
 // 3,600 seconds (1 hour), with a default of 1 hour.
 //
-// Permissions
-//
 // The temporary security credentials created by GetSessionToken can be used
 // to make API calls to any AWS service with the following exceptions:
 //
@@ -1384,16 +1213,16 @@ type AssumeRoleInput struct {
 	// in the IAM User Guide.
 	//
 	// The plain text that you use for both inline and managed session policies
-	// can't exceed 2,048 characters. The JSON policy characters can be any ASCII
+	// shouldn't exceed 2048 characters. The JSON policy characters can be any ASCII
 	// character from the space character to the end of the valid character list
 	// (\u0020 through \u00FF). It can also include the tab (\u0009), linefeed (\u000A),
 	// and carriage return (\u000D) characters.
 	//
-	// An AWS conversion compresses the passed session policies and session tags
-	// into a packed binary format that has a separate limit. Your request can fail
-	// for this limit even if your plain text meets the other requirements. The
-	// PackedPolicySize response element indicates by percentage how close the policies
-	// and tags for your request are to the upper size limit.
+	// The characters in this parameter count towards the 2048 character session
+	// policy guideline. However, an AWS conversion compresses the session policies
+	// into a packed binary format that has a separate limit. This is the enforced
+	// limit. The PackedPolicySize response element indicates by percentage how
+	// close the policy is to the upper size limit.
 	Policy *string `min:"1" type:"string"`
 
 	// The Amazon Resource Names (ARNs) of the IAM managed policies that you want
@@ -1402,15 +1231,15 @@ type AssumeRoleInput struct {
 	//
 	// This parameter is optional. You can provide up to 10 managed policy ARNs.
 	// However, the plain text that you use for both inline and managed session
-	// policies can't exceed 2,048 characters. For more information about ARNs,
+	// policies shouldn't exceed 2048 characters. For more information about ARNs,
 	// see Amazon Resource Names (ARNs) and AWS Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
 	// in the AWS General Reference.
 	//
-	// An AWS conversion compresses the passed session policies and session tags
-	// into a packed binary format that has a separate limit. Your request can fail
-	// for this limit even if your plain text meets the other requirements. The
-	// PackedPolicySize response element indicates by percentage how close the policies
-	// and tags for your request are to the upper size limit.
+	// The characters in this parameter count towards the 2048 character session
+	// policy guideline. However, an AWS conversion compresses the session policies
+	// into a packed binary format that has a separate limit. This is the enforced
+	// limit. The PackedPolicySize response element indicates by percentage how
+	// close the policy is to the upper size limit.
 	//
 	// Passing policies to this operation returns new temporary credentials. The
 	// resulting session's permissions are the intersection of the role's identity-based
@@ -1455,41 +1284,6 @@ type AssumeRoleInput struct {
 	// also include underscores or any of the following characters: =,.@-
 	SerialNumber *string `min:"9" type:"string"`
 
-	// A list of session tags that you want to pass. Each session tag consists of
-	// a key name and an associated value. For more information about session tags,
-	// see Tagging AWS STS Sessions (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
-	// in the IAM User Guide.
-	//
-	// This parameter is optional. You can pass up to 50 session tags. The plain
-	// text session tag keys can’t exceed 128 characters, and the values can’t
-	// exceed 256 characters. For these and additional limits, see IAM and STS Character
-	// Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length)
-	// in the IAM User Guide.
-	//
-	// An AWS conversion compresses the passed session policies and session tags
-	// into a packed binary format that has a separate limit. Your request can fail
-	// for this limit even if your plain text meets the other requirements. The
-	// PackedPolicySize response element indicates by percentage how close the policies
-	// and tags for your request are to the upper size limit.
-	//
-	// You can pass a session tag with the same key as a tag that is already attached
-	// to the role. When you do, session tags override a role tag with the same
-	// key.
-	//
-	// Tag key–value pairs are not case sensitive, but case is preserved. This
-	// means that you cannot have separate Department and department tag keys. Assume
-	// that the role has the Department=Marketing tag and you pass the department=engineering
-	// session tag. Department and department are not saved as separate tags, and
-	// the session tag passed in the request takes precedence over the role tag.
-	//
-	// Additionally, if you used temporary credentials to perform this operation,
-	// the new session inherits any transitive session tags from the calling session.
-	// If you pass a session tag with the same key as an inherited tag, the operation
-	// fails. To view the inherited tags for a session, see the AWS CloudTrail logs.
-	// For more information, see Viewing Session Tags in CloudTrail (https://docs.aws.amazon.com/IAM/latest/UserGuide/session-tags.html#id_session-tags_ctlogs)
-	// in the IAM User Guide.
-	Tags []*Tag `type:"list"`
-
 	// The value provided by the MFA device, if the trust policy of the role being
 	// assumed requires MFA (that is, if the policy includes a condition that tests
 	// for MFA). If the role being assumed requires MFA and if the TokenCode value
@@ -1498,19 +1292,6 @@ type AssumeRoleInput struct {
 	// The format for this parameter, as described by its regex pattern, is a sequence
 	// of six numeric digits.
 	TokenCode *string `min:"6" type:"string"`
-
-	// A list of keys for session tags that you want to set as transitive. If you
-	// set a tag key as transitive, the corresponding key and value passes to subsequent
-	// sessions in a role chain. For more information, see Chaining Roles with Session
-	// Tags (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining)
-	// in the IAM User Guide.
-	//
-	// This parameter is optional. When you set session tags as transitive, the
-	// session policy and session tags packed binary limit is not affected.
-	//
-	// If you choose not to specify a transitive tag key, then no tags are passed
-	// from this session to any subsequent sessions.
-	TransitiveTagKeys []*string `type:"list"`
 }
 
 // String returns the string representation
@@ -1563,16 +1344,6 @@ func (s *AssumeRoleInput) Validate() error {
 			}
 		}
 	}
-	if s.Tags != nil {
-		for i, v := range s.Tags {
-			if v == nil {
-				continue
-			}
-			if err := v.Validate(); err != nil {
-				invalidParams.AddNested(fmt.Sprintf("%s[%v]", "Tags", i), err.(request.ErrInvalidParams))
-			}
-		}
-	}
 
 	if invalidParams.Len() > 0 {
 		return invalidParams
@@ -1622,24 +1393,12 @@ func (s *AssumeRoleInput) SetSerialNumber(v string) *AssumeRoleInput {
 	return s
 }
 
-// SetTags sets the Tags field's value.
-func (s *AssumeRoleInput) SetTags(v []*Tag) *AssumeRoleInput {
-	s.Tags = v
-	return s
-}
-
 // SetTokenCode sets the TokenCode field's value.
 func (s *AssumeRoleInput) SetTokenCode(v string) *AssumeRoleInput {
 	s.TokenCode = &v
 	return s
 }
 
-// SetTransitiveTagKeys sets the TransitiveTagKeys field's value.
-func (s *AssumeRoleInput) SetTransitiveTagKeys(v []*string) *AssumeRoleInput {
-	s.TransitiveTagKeys = v
-	return s
-}
-
 // Contains the response to a successful AssumeRole request, including temporary
 // AWS credentials that can be used to make AWS requests.
 type AssumeRoleOutput struct {
@@ -1659,10 +1418,9 @@ type AssumeRoleOutput struct {
 	// We strongly recommend that you make no assumptions about the maximum size.
 	Credentials *Credentials `type:"structure"`
 
-	// A percentage value that indicates the packed size of the session policies
-	// and session tags combined passed in the request. The request fails if the
-	// packed size is greater than 100 percent, which means the policies and tags
-	// exceeded the allowed space.
+	// A percentage value that indicates the size of the policy in packed form.
+	// The service rejects any policy with a packed size greater than 100 percent,
+	// which means the policy exceeded the allowed space.
 	PackedPolicySize *int64 `type:"integer"`
 }
 
@@ -1733,16 +1491,16 @@ type AssumeRoleWithSAMLInput struct {
 	// in the IAM User Guide.
 	//
 	// The plain text that you use for both inline and managed session policies
-	// can't exceed 2,048 characters. The JSON policy characters can be any ASCII
+	// shouldn't exceed 2048 characters. The JSON policy characters can be any ASCII
 	// character from the space character to the end of the valid character list
 	// (\u0020 through \u00FF). It can also include the tab (\u0009), linefeed (\u000A),
 	// and carriage return (\u000D) characters.
 	//
-	// An AWS conversion compresses the passed session policies and session tags
-	// into a packed binary format that has a separate limit. Your request can fail
-	// for this limit even if your plain text meets the other requirements. The
-	// PackedPolicySize response element indicates by percentage how close the policies
-	// and tags for your request are to the upper size limit.
+	// The characters in this parameter count towards the 2048 character session
+	// policy guideline. However, an AWS conversion compresses the session policies
+	// into a packed binary format that has a separate limit. This is the enforced
+	// limit. The PackedPolicySize response element indicates by percentage how
+	// close the policy is to the upper size limit.
 	Policy *string `min:"1" type:"string"`
 
 	// The Amazon Resource Names (ARNs) of the IAM managed policies that you want
@@ -1751,15 +1509,15 @@ type AssumeRoleWithSAMLInput struct {
 	//
 	// This parameter is optional. You can provide up to 10 managed policy ARNs.
 	// However, the plain text that you use for both inline and managed session
-	// policies can't exceed 2,048 characters. For more information about ARNs,
+	// policies shouldn't exceed 2048 characters. For more information about ARNs,
 	// see Amazon Resource Names (ARNs) and AWS Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
 	// in the AWS General Reference.
 	//
-	// An AWS conversion compresses the passed session policies and session tags
-	// into a packed binary format that has a separate limit. Your request can fail
-	// for this limit even if your plain text meets the other requirements. The
-	// PackedPolicySize response element indicates by percentage how close the policies
-	// and tags for your request are to the upper size limit.
+	// The characters in this parameter count towards the 2048 character session
+	// policy guideline. However, an AWS conversion compresses the session policies
+	// into a packed binary format that has a separate limit. This is the enforced
+	// limit. The PackedPolicySize response element indicates by percentage how
+	// close the policy is to the upper size limit.
 	//
 	// Passing policies to this operation returns new temporary credentials. The
 	// resulting session's permissions are the intersection of the role's identity-based
@@ -1915,10 +1673,9 @@ type AssumeRoleWithSAMLOutput struct {
 	// ) )
 	NameQualifier *string `type:"string"`
 
-	// A percentage value that indicates the packed size of the session policies
-	// and session tags combined passed in the request. The request fails if the
-	// packed size is greater than 100 percent, which means the policies and tags
-	// exceeded the allowed space.
+	// A percentage value that indicates the size of the policy in packed form.
+	// The service rejects any policy with a packed size greater than 100 percent,
+	// which means the policy exceeded the allowed space.
 	PackedPolicySize *int64 `type:"integer"`
 
 	// The value of the NameID element in the Subject element of the SAML assertion.
@@ -2029,16 +1786,16 @@ type AssumeRoleWithWebIdentityInput struct {
 	// in the IAM User Guide.
 	//
 	// The plain text that you use for both inline and managed session policies
-	// can't exceed 2,048 characters. The JSON policy characters can be any ASCII
+	// shouldn't exceed 2048 characters. The JSON policy characters can be any ASCII
 	// character from the space character to the end of the valid character list
 	// (\u0020 through \u00FF). It can also include the tab (\u0009), linefeed (\u000A),
 	// and carriage return (\u000D) characters.
 	//
-	// An AWS conversion compresses the passed session policies and session tags
-	// into a packed binary format that has a separate limit. Your request can fail
-	// for this limit even if your plain text meets the other requirements. The
-	// PackedPolicySize response element indicates by percentage how close the policies
-	// and tags for your request are to the upper size limit.
+	// The characters in this parameter count towards the 2048 character session
+	// policy guideline. However, an AWS conversion compresses the session policies
+	// into a packed binary format that has a separate limit. This is the enforced
+	// limit. The PackedPolicySize response element indicates by percentage how
+	// close the policy is to the upper size limit.
 	Policy *string `min:"1" type:"string"`
 
 	// The Amazon Resource Names (ARNs) of the IAM managed policies that you want
@@ -2047,15 +1804,15 @@ type AssumeRoleWithWebIdentityInput struct {
 	//
 	// This parameter is optional. You can provide up to 10 managed policy ARNs.
 	// However, the plain text that you use for both inline and managed session
-	// policies can't exceed 2,048 characters. For more information about ARNs,
+	// policies shouldn't exceed 2048 characters. For more information about ARNs,
 	// see Amazon Resource Names (ARNs) and AWS Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
 	// in the AWS General Reference.
 	//
-	// An AWS conversion compresses the passed session policies and session tags
-	// into a packed binary format that has a separate limit. Your request can fail
-	// for this limit even if your plain text meets the other requirements. The
-	// PackedPolicySize response element indicates by percentage how close the policies
-	// and tags for your request are to the upper size limit.
+	// The characters in this parameter count towards the 2048 character session
+	// policy guideline. However, an AWS conversion compresses the session policies
+	// into a packed binary format that has a separate limit. This is the enforced
+	// limit. The PackedPolicySize response element indicates by percentage how
+	// close the policy is to the upper size limit.
 	//
 	// Passing policies to this operation returns new temporary credentials. The
 	// resulting session's permissions are the intersection of the role's identity-based
@@ -2226,10 +1983,9 @@ type AssumeRoleWithWebIdentityOutput struct {
 	// We strongly recommend that you make no assumptions about the maximum size.
 	Credentials *Credentials `type:"structure"`
 
-	// A percentage value that indicates the packed size of the session policies
-	// and session tags combined passed in the request. The request fails if the
-	// packed size is greater than 100 percent, which means the policies and tags
-	// exceeded the allowed space.
+	// A percentage value that indicates the size of the policy in packed form.
+	// The service rejects any policy with a packed size greater than 100 percent,
+	// which means the policy exceeded the allowed space.
 	PackedPolicySize *int64 `type:"integer"`
 
 	// The issuing authority of the web identity token presented. For OpenID Connect
@@ -2301,7 +2057,7 @@ type AssumedRoleUser struct {
 	// The ARN of the temporary security credentials that are returned from the
 	// AssumeRole action. For more information about ARNs and how to use them in
 	// policies, see IAM Identifiers (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html)
-	// in the IAM User Guide.
+	// in Using IAM.
 	//
 	// Arn is a required field
 	Arn *string `min:"20" type:"string" required:"true"`
@@ -2469,7 +2225,7 @@ type FederatedUser struct {
 	// The ARN that specifies the federated user that is associated with the credentials.
 	// For more information about ARNs and how to use them in policies, see IAM
 	// Identifiers (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html)
-	// in the IAM User Guide.
+	// in Using IAM.
 	//
 	// Arn is a required field
 	Arn *string `min:"20" type:"string" required:"true"`
@@ -2509,7 +2265,7 @@ type GetAccessKeyInfoInput struct {
 	// The identifier of an access key.
 	//
 	// This parameter allows (through its regex pattern) a string of characters
-	// that can consist of any upper- or lowercase letter or digit.
+	// that can consist of any upper- or lowercased letter or digit.
 	//
 	// AccessKeyId is a required field
 	AccessKeyId *string `min:"16" type:"string" required:"true"`
@@ -2662,7 +2418,10 @@ type GetFederationTokenInput struct {
 	// use as managed session policies.
 	//
 	// This parameter is optional. However, if you do not pass any session policies,
-	// then the resulting federated user session has no permissions.
+	// then the resulting federated user session has no permissions. The only exception
+	// is when the credentials are used to access a resource that has a resource-based
+	// policy that specifically references the federated user session in the Principal
+	// element of the policy.
 	//
 	// When you pass session policies, the session permissions are the intersection
 	// of the IAM user policies and the session policies that you pass. This gives
@@ -2672,23 +2431,17 @@ type GetFederationTokenInput struct {
 	// Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
 	// in the IAM User Guide.
 	//
-	// The resulting credentials can be used to access a resource that has a resource-based
-	// policy. If that policy specifically references the federated user session
-	// in the Principal element of the policy, the session has the permissions allowed
-	// by the policy. These permissions are granted in addition to the permissions
-	// that are granted by the session policies.
-	//
 	// The plain text that you use for both inline and managed session policies
-	// can't exceed 2,048 characters. The JSON policy characters can be any ASCII
+	// shouldn't exceed 2048 characters. The JSON policy characters can be any ASCII
 	// character from the space character to the end of the valid character list
 	// (\u0020 through \u00FF). It can also include the tab (\u0009), linefeed (\u000A),
 	// and carriage return (\u000D) characters.
 	//
-	// An AWS conversion compresses the passed session policies and session tags
-	// into a packed binary format that has a separate limit. Your request can fail
-	// for this limit even if your plain text meets the other requirements. The
-	// PackedPolicySize response element indicates by percentage how close the policies
-	// and tags for your request are to the upper size limit.
+	// The characters in this parameter count towards the 2048 character session
+	// policy guideline. However, an AWS conversion compresses the session policies
+	// into a packed binary format that has a separate limit. This is the enforced
+	// limit. The PackedPolicySize response element indicates by percentage how
+	// close the policy is to the upper size limit.
 	Policy *string `min:"1" type:"string"`
 
 	// The Amazon Resource Names (ARNs) of the IAM managed policies that you want
@@ -2699,13 +2452,16 @@ type GetFederationTokenInput struct {
 	// to this operation. You can pass a single JSON policy document to use as an
 	// inline session policy. You can also specify up to 10 managed policies to
 	// use as managed session policies. The plain text that you use for both inline
-	// and managed session policies can't exceed 2,048 characters. You can provide
+	// and managed session policies shouldn't exceed 2048 characters. You can provide
 	// up to 10 managed policy ARNs. For more information about ARNs, see Amazon
 	// Resource Names (ARNs) and AWS Service Namespaces (https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)
 	// in the AWS General Reference.
 	//
 	// This parameter is optional. However, if you do not pass any session policies,
-	// then the resulting federated user session has no permissions.
+	// then the resulting federated user session has no permissions. The only exception
+	// is when the credentials are used to access a resource that has a resource-based
+	// policy that specifically references the federated user session in the Principal
+	// element of the policy.
 	//
 	// When you pass session policies, the session permissions are the intersection
 	// of the IAM user policies and the session policies that you pass. This gives
@@ -2715,46 +2471,12 @@ type GetFederationTokenInput struct {
 	// Policies (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session)
 	// in the IAM User Guide.
 	//
-	// The resulting credentials can be used to access a resource that has a resource-based
-	// policy. If that policy specifically references the federated user session
-	// in the Principal element of the policy, the session has the permissions allowed
-	// by the policy. These permissions are granted in addition to the permissions
-	// that are granted by the session policies.
-	//
-	// An AWS conversion compresses the passed session policies and session tags
-	// into a packed binary format that has a separate limit. Your request can fail
-	// for this limit even if your plain text meets the other requirements. The
-	// PackedPolicySize response element indicates by percentage how close the policies
-	// and tags for your request are to the upper size limit.
+	// The characters in this parameter count towards the 2048 character session
+	// policy guideline. However, an AWS conversion compresses the session policies
+	// into a packed binary format that has a separate limit. This is the enforced
+	// limit. The PackedPolicySize response element indicates by percentage how
+	// close the policy is to the upper size limit.
 	PolicyArns []*PolicyDescriptorType `type:"list"`
-
-	// A list of session tags. Each session tag consists of a key name and an associated
-	// value. For more information about session tags, see Passing Session Tags
-	// in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
-	// in the IAM User Guide.
-	//
-	// This parameter is optional. You can pass up to 50 session tags. The plain
-	// text session tag keys can’t exceed 128 characters and the values can’t
-	// exceed 256 characters. For these and additional limits, see IAM and STS Character
-	// Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length)
-	// in the IAM User Guide.
-	//
-	// An AWS conversion compresses the passed session policies and session tags
-	// into a packed binary format that has a separate limit. Your request can fail
-	// for this limit even if your plain text meets the other requirements. The
-	// PackedPolicySize response element indicates by percentage how close the policies
-	// and tags for your request are to the upper size limit.
-	//
-	// You can pass a session tag with the same key as a tag that is already attached
-	// to the user you are federating. When you do, session tags override a user
-	// tag with the same key.
-	//
-	// Tag key–value pairs are not case sensitive, but case is preserved. This
-	// means that you cannot have separate Department and department tag keys. Assume
-	// that the role has the Department=Marketing tag and you pass the department=engineering
-	// session tag. Department and department are not saved as separate tags, and
-	// the session tag passed in the request takes precedence over the role tag.
-	Tags []*Tag `type:"list"`
 }
 
 // String returns the string representation
@@ -2792,16 +2514,6 @@ func (s *GetFederationTokenInput) Validate() error {
 			}
 		}
 	}
-	if s.Tags != nil {
-		for i, v := range s.Tags {
-			if v == nil {
-				continue
-			}
-			if err := v.Validate(); err != nil {
-				invalidParams.AddNested(fmt.Sprintf("%s[%v]", "Tags", i), err.(request.ErrInvalidParams))
-			}
-		}
-	}
 
 	if invalidParams.Len() > 0 {
 		return invalidParams
@@ -2833,12 +2545,6 @@ func (s *GetFederationTokenInput) SetPolicyArns(v []*PolicyDescriptorType) *GetF
 	return s
 }
 
-// SetTags sets the Tags field's value.
-func (s *GetFederationTokenInput) SetTags(v []*Tag) *GetFederationTokenInput {
-	s.Tags = v
-	return s
-}
-
 // Contains the response to a successful GetFederationToken request, including
 // temporary AWS credentials that can be used to make AWS requests.
 type GetFederationTokenOutput struct {
@@ -2857,10 +2563,9 @@ type GetFederationTokenOutput struct {
 	// an Amazon S3 bucket policy.
 	FederatedUser *FederatedUser `type:"structure"`
 
-	// A percentage value that indicates the packed size of the session policies
-	// and session tags combined passed in the request. The request fails if the
-	// packed size is greater than 100 percent, which means the policies and tags
-	// exceeded the allowed space.
+	// A percentage value indicating the size of the policy in packed form. The
+	// service rejects policies for which the packed size is greater than 100 percent
+	// of the allowed value.
 	PackedPolicySize *int64 `type:"integer"`
 }
 
@@ -3043,73 +2748,3 @@ func (s *PolicyDescriptorType) SetArn(v string) *PolicyDescriptorType {
 	s.Arn = &v
 	return s
 }
-
-// You can pass custom key-value pair attributes when you assume a role or federate
-// a user. These are called session tags. You can then use the session tags
-// to control access to resources. For more information, see Tagging AWS STS
-// Sessions (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
-// in the IAM User Guide.
-type Tag struct {
-	_ struct{} `type:"structure"`
-
-	// The key for a session tag.
-	//
-	// You can pass up to 50 session tags. The plain text session tag keys can’t
-	// exceed 128 characters. For these and additional limits, see IAM and STS Character
-	// Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length)
-	// in the IAM User Guide.
-	//
-	// Key is a required field
-	Key *string `min:"1" type:"string" required:"true"`
-
-	// The value for a session tag.
-	//
-	// You can pass up to 50 session tags. The plain text session tag values can’t
-	// exceed 256 characters. For these and additional limits, see IAM and STS Character
-	// Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length)
-	// in the IAM User Guide.
-	//
-	// Value is a required field
-	Value *string `type:"string" required:"true"`
-}
-
-// String returns the string representation
-func (s Tag) String() string {
-	return awsutil.Prettify(s)
-}
-
-// GoString returns the string representation
-func (s Tag) GoString() string {
-	return s.String()
-}
-
-// Validate inspects the fields of the type to determine if they are valid.
-func (s *Tag) Validate() error {
-	invalidParams := request.ErrInvalidParams{Context: "Tag"}
-	if s.Key == nil {
-		invalidParams.Add(request.NewErrParamRequired("Key"))
-	}
-	if s.Key != nil && len(*s.Key) < 1 {
-		invalidParams.Add(request.NewErrParamMinLen("Key", 1))
-	}
-	if s.Value == nil {
-		invalidParams.Add(request.NewErrParamRequired("Value"))
-	}
-
-	if invalidParams.Len() > 0 {
-		return invalidParams
-	}
-	return nil
-}
-
-// SetKey sets the Key field's value.
-func (s *Tag) SetKey(v string) *Tag {
-	s.Key = &v
-	return s
-}
-
-// SetValue sets the Value field's value.
-func (s *Tag) SetValue(v string) *Tag {
-	s.Value = &v
-	return s
-}

vendor/github.com/aws/aws-sdk-go/service/sts/errors.go

@@ -14,11 +14,11 @@ const (
 	// ErrCodeIDPCommunicationErrorException for service response error code
 	// "IDPCommunicationError".
 	//
-	// The request could not be fulfilled because the identity provider (IDP) that
-	// was asked to verify the incoming identity token could not be reached. This
-	// is often a transient error caused by network conditions. Retry the request
+	// The request could not be fulfilled because the non-AWS identity provider
+	// (IDP) that was asked to verify the incoming identity token could not be reached.
+	// This is often a transient error caused by network conditions. Retry the request
 	// a limited number of times so that you don't exceed the request rate. If the
-	// error persists, the identity provider might be down or not responding.
+	// error persists, the non-AWS identity provider might be down or not responding.
 	ErrCodeIDPCommunicationErrorException = "IDPCommunicationError"
 
 	// ErrCodeIDPRejectedClaimException for service response error code
@@ -34,9 +34,9 @@ const (
 	// ErrCodeInvalidAuthorizationMessageException for service response error code
 	// "InvalidAuthorizationMessageException".
 	//
-	// The error returned if the message passed to DecodeAuthorizationMessage was
-	// invalid. This can happen if the token contains invalid characters, such as
-	// linebreaks.
+	// This error is returned if the message passed to DecodeAuthorizationMessage
+	// was invalid. This can happen if the token contains invalid characters, such
+	// as linebreaks.
 	ErrCodeInvalidAuthorizationMessageException = "InvalidAuthorizationMessageException"
 
 	// ErrCodeInvalidIdentityTokenException for service response error code
@@ -56,18 +56,9 @@ const (
 	// ErrCodePackedPolicyTooLargeException for service response error code
 	// "PackedPolicyTooLarge".
 	//
-	// The request was rejected because the total packed size of the session policies
-	// and session tags combined was too large. An AWS conversion compresses the
-	// session policy document, session policy ARNs, and session tags into a packed
-	// binary format that has a separate limit. The error message indicates by percentage
-	// how close the policies and tags are to the upper size limit. For more information,
-	// see Passing Session Tags in STS (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html)
-	// in the IAM User Guide.
-	//
-	// You could receive this error even though you meet other defined session policy
-	// and session tag limits. For more information, see IAM and STS Entity Character
-	// Limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html)
-	// in the IAM User Guide.
+	// The request was rejected because the policy document was too large. The error
+	// message describes how big the policy document is, in packed form, as a percentage
+	// of what the API allows.
 	ErrCodePackedPolicyTooLargeException = "PackedPolicyTooLarge"
 
 	// ErrCodeRegionDisabledException for service response error code

vendor/github.com/aws/aws-sdk-go/service/sts/service.go

@@ -31,7 +31,7 @@ var initRequest func(*request.Request)
 const (
 	ServiceName = "sts"       // Name of service.
 	EndpointsID = ServiceName // ID to lookup a service endpoint with.
-	ServiceID   = "STS"       // ServiceID is a unique identifier of a specific service.
+	ServiceID   = "STS"       // ServiceID is a unique identifer of a specific service.
 )
 
 // New creates a new instance of the STS client with a session.
@@ -39,8 +39,6 @@ const (
 // aws.Config parameter to add your extra config.
 //
 // Example:
-//     mySession := session.Must(session.NewSession())
-//
 //     // Create a STS client from just a session.
 //     svc := sts.New(mySession)
 //
@@ -48,11 +46,11 @@ const (
 //     svc := sts.New(mySession, aws.NewConfig().WithRegion("us-west-2"))
 func New(p client.ConfigProvider, cfgs ...*aws.Config) *STS {
 	c := p.ClientConfig(EndpointsID, cfgs...)
-	return newClient(*c.Config, c.Handlers, c.PartitionID, c.Endpoint, c.SigningRegion, c.SigningName)
+	return newClient(*c.Config, c.Handlers, c.Endpoint, c.SigningRegion, c.SigningName)
 }
 
 // newClient creates, initializes and returns a new service client instance.
-func newClient(cfg aws.Config, handlers request.Handlers, partitionID, endpoint, signingRegion, signingName string) *STS {
+func newClient(cfg aws.Config, handlers request.Handlers, endpoint, signingRegion, signingName string) *STS {
 	svc := &STS{
 		Client: client.New(
 			cfg,
@@ -61,7 +59,6 @@ func newClient(cfg aws.Config, handlers request.Handlers, partitionID, endpoint,
 				ServiceID:     ServiceID,
 				SigningName:   signingName,
 				SigningRegion: signingRegion,
-				PartitionID:   partitionID,
 				Endpoint:      endpoint,
 				APIVersion:    "2011-06-15",
 			},