diff --git a/walkthroughs/tls-with-acm/.gitignore b/walkthroughs/tls-with-acm/.gitignore
new file mode 100644
index 00000000..612424a3
--- /dev/null
+++ b/walkthroughs/tls-with-acm/.gitignore
@@ -0,0 +1 @@
+*.pem
\ No newline at end of file
diff --git a/walkthroughs/tls-with-acm/README.md b/walkthroughs/tls-with-acm/README.md
new file mode 100644
index 00000000..53a5a06a
--- /dev/null
+++ b/walkthroughs/tls-with-acm/README.md
@@ -0,0 +1,233 @@
+# Configuring TLS with AWS Certificate Manager
+
+In this walkthrough we'll enable TLS encryption between two services in App Mesh using X.509 certificates provided by AWS Certificate Manager (ACM). This walkthrough will be a simplified version of the [Color App Example](https://github.com/aws/aws-app-mesh-examples/tree/master/examples/apps/colorapp).
+
+## Introduction
+
+In App Mesh, traffic encryption works between Virtual Nodes, and thus between Envoys in your service mesh. This means your application code is not responsible for negotiating a TLS-encrypted session, instead allowing the local proxy to negotiate and terminate TLS on your application's behalf.
+
+With ACM, you can host some or all of your Public Key Infrastructure (PKI) in AWS, and App Mesh will automatically distribute the certificates to the Envoys configured by your Virtual Nodes. App Mesh also automatically distributes the appropriate TLS validation context to other Virtual Nodes which depend on your service by way of a Virtual Service.
+
+Let's jump into a brief example of App Mesh TLS in action.
+
+## Step 1: Download the App Mesh Preview CLI
+
+You will need the latest version of the App Mesh Preview CLI for this walkthrough. You can download and use the latest version using the command below.
+
+```bash
+aws configure add-model \
+        --service-name appmesh-preview \
+        --service-model https://raw.githubusercontent.com/aws/aws-app-mesh-roadmap/master/appmesh-preview/service-model.json
+```
+
+Additionally, this walkthrough makes use of the unix command line utility `jq`. If you don't already have it, you can install it from [here](https://stedolan.github.io/jq/).
+
+## Step 1: Create Color App Infrastructure
+
+We'll start by setting up the basic infrastructure for our services. All commands will be provided as if run from the same directory as this README.
+
+```bash
+export AWS_ACCOUNT_ID=<your account id>
+export KEY_PAIR_NAME=<your SSH key pair stored in AWS>
+export AWS_DEFAULT_REGION=us-west-2
+export ENVIRONMENT_NAME=AppMeshTLSExample
+export MESH_NAME=ColorApp-TLS
+export ENVOY_IMAGE="111345817488.dkr.ecr.us-west-2.amazonaws.com/aws-appmesh-envoy:v1.9.1.0-prod"
+export SERVICES_DOMAIN="default.svc.cluster.local"
+export COLOR_GATEWAY_IMAGE="${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_DEFAULT_REGION}.amazonaws.com/gateway:latest"
+export COLOR_TELLER_IMAGE="${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_DEFAULT_REGION}.amazonaws.com/colorteller:latest"
+```
+
+First, create the VPC.
+
+```bash
+./infrastructure/vpc.sh
+```
+
+Next, create the ECS cluster and ECR repositories.
+
+```bash
+./infrastructure/ecs-cluster.sh
+./infrastructure/ecr-repositories.sh
+```
+
+Finally, build and deploy the color app images.
+
+```bash
+./src/colorteller/deploy.sh
+./src/gateway/deploy.sh
+```
+
+## Step 2: Create a Certificate
+
+Before we can encrypt traffic between services in the mesh, we need to generate a certificate.
+
+To keep things simple, we'll use a single self-signed certificate for this walkthrough. However, you can also use certificates signed by an ACM Private Certificate Authority to enable TLS encryption in App Mesh. [See below](##extra-create-a-private-certificate-authority-and-certificate) for how to create a Private Certificate Authority and certificate.
+
+This certificate will be used to encrypt traffic between the color teller and color gateway Virtual Nodes. In case you want to experiment further after this walkthrough, we'll create a wildcard certificate for the whole service domain, but we'll only be applying it to the Color Teller Virtual Node.
+
+```bash
+openssl req \
+       -newkey rsa:2048 -nodes -keyout colorapp-wildcard.key.pem \
+       -subj "/C=US/ST=Washington/L=Seattle/O=Meshy Co/OU=My Mesh/CN=*.${SERVICES_DOMAIN}" \
+       -x509 -days 365 -out colorapp-wildcard.cert.pem
+```
+
+Next we'll import this certificate into ACM for use with App Mesh.
+
+> Note: You pay a monthly fee for each certificate you import to AWS Certificate Manager. For more information, see [AWS Certificate Manager Pricing](https://aws.amazon.com/certificate-manager/pricing/).
+
+```bash
+export CERTIFICATE_ARN=`aws acm import-certificate \
+    --certificate file://colorapp-wildcard.cert.pem \
+    --private-key file://colorapp-wildcard.key.pem \
+    --query CertificateArn --output text`
+```
+
+## Step 3: Create a TLS enabled mesh
+
+This mesh will be a simplified version of the original Color App Example, so we'll only be deploying the gateway and one color teller service (white). We'll be encrypting traffic from the gateway to the color teller node. As such, our color teller white Virtual Node spec looks like this:
+
+```json
+"listeners": [
+    {
+        "portMapping": {
+            "port": 9080,
+            "protocol": "http"
+        },
+        "healthCheck": {
+            "protocol": "http",
+            "path": "/ping",
+            "healthyThreshold": 2,
+            "unhealthyThreshold": 2,
+            "timeoutMillis": 2000,
+            "intervalMillis": 5000
+        },
+        "tls": {
+            "mode": "STRICT",
+            "certificate": {
+                "acm": {
+                    "certificateArn": "${CERTIFICATE_ARN}"
+                }
+            }
+        }
+    }
+],
+"serviceDiscovery": {
+    "dns": {
+        "hostname": "colorteller.${SERVICES_DOMAIN}"
+    }
+}
+```
+
+For more information on what TLS settings you can provide for a Virtual Node, see the [TLS Encryption](https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual-node-tls.html) documentation.
+
+Let's create the mesh.
+
+```bash
+./mesh/mesh.sh up
+```
+
+## Step 4: Deploy and Verify
+
+Our final step is to deploy the service and test it out.
+
+```bash
+./infrastructure/ecs-service.sh
+```
+
+Let's issue a request to the color gateway.
+
+```bash
+COLORAPP_ENDPOINT=$(aws cloudformation describe-stacks \
+    --stack-name $ENVIRONMENT_NAME-ecs-service \
+    | jq -r '.Stacks[0].Outputs[] | select(.OutputKey=="ColorAppEndpoint") | .OutputValue')
+curl "${COLORAPP_ENDPOINT}/color"
+```
+
+You should see a successful response with the color white.
+
+Finally, let's log in to the bastion host and check the SSL handshake statistics.
+
+```bash
+BASTION_IP=$(aws cloudformation describe-stacks \
+    --stack-name $ENVIRONMENT_NAME-ecs-cluster \
+    | jq -r '.Stacks[0].Outputs[] | select(.OutputKey=="BastionIP") | .OutputValue')
+ssh ec2-user@$BASTION_IP
+curl -s http://colorteller.default.svc.cluster.local:9901/stats | grep ssl.handshake
+```
+
+You should see output similar to: `listener.0.0.0.0_15000.ssl.handshake: 1`, indicating a successful SSL handshake was achieved between gateway and color teller.
+
+That's it! We've encrypted traffic from our gateway service to our color teller white service using a certificate from ACM.
+
+Check out the [TLS Encryption](https://docs.aws.amazon.com/app-mesh/latest/userguide/virtual-node-tls.html) documentation for more information on enabling encryption between services in App Mesh.
+
+## Extra: Create a Private Certificate Authority and Certificate
+
+This section walks through creating your entire PKI within AWS Certificate Manager. We'll focus on a simple hierarchy with a root certificate authority (CA) and end-entity certificate, but you may wish to create additional hierarchy with intermediate CAs for your real mesh.
+
+Start by creating a root certificate authority (CA) in ACM.
+
+> You pay a monthly fee for the operation of each AWS Certificate Manager Private Certificate Authority until you delete it and you pay for the private certificates you issue each month. For more information, see [AWS Certificate Manager Pricing](https://aws.amazon.com/certificate-manager/pricing/).
+
+```bash
+ROOT_CA_ARN=`aws acm-pca create-certificate-authority \
+    --certificate-authority-type ROOT \
+    --certificate-authority-configuration \
+    "KeyAlgorithm=RSA_2048,
+    SigningAlgorithm=SHA256WITHRSA,
+    Subject={
+        Country=US,
+        State=WA,
+        Locality=Seattle,
+        Organization=Meshy Co,
+        OrganizationalUnit=My Mesh,
+        SerialNumber=1001,
+        CommonName=${SERVICES_DOMAIN}}" \
+        --query CertificateAuthorityArn --output text`
+```
+
+Next you need to self-sign your root CA. Start by retrieving the CSR contents:
+
+```bash
+ROOT_CA_CSR=`aws acm-pca get-certificate-authority-csr \
+    --certificate-authority-arn ${ROOT_CA_ARN} \
+    --query Csr --output text`
+```
+
+Sign the CSR using itself as the issuer:
+
+```bash
+ROOT_CA_CERT_ARN=`aws acm-pca issue-certificate \
+    --certificate-authority-arn ${ROOT_CA_ARN} \
+    --template-arn arn:aws:acm-pca:::template/RootCACertificate/V1 \
+    --signing-algorithm SHA256WITHRSA \
+    --validity Value=10,Type=YEARS \
+    --csr ${ROOT_CA_CSR} \
+    --query CertificateArn --output text`
+```
+
+Then import the signed certificate as the root CA:
+
+```bash
+ROOT_CA_CERT=`aws acm-pca get-certificate \
+    --certificate-arn ${ROOT_CA_CERT_ARN} \
+    --certificate-authority-arn ${ROOT_CA_ARN} \
+    --query Certificate --output text`
+
+aws acm-pca import-certificate-authority-certificate \
+    --certificate-authority-arn $ROOT_CA_ARN \
+    --certificate $ROOT_CA_CERT
+```
+
+Now you can request a managed certificate from ACM using this CA:
+
+```bash
+export CERTIFICATE_ARN=`aws acm request-certificate \
+    --domain-name "*.${SERVICES_DOMAIN}" \
+    --certificate-authority-arn ${ROOT_CA_ARN} \
+    --query CertificateArn --output text`
+```
+
+With managed certificates, ACM will automatically renew certificates that are nearing the end of their validity, and App Mesh will automatically distribute the renewed certificates. See [Managed Renewal and Deployment](https://aws.amazon.com/certificate-manager/faqs/#Managed_Renewal_and_Deployment) for more information.
diff --git a/walkthroughs/tls-with-acm/infrastructure/ecr-repositories.sh b/walkthroughs/tls-with-acm/infrastructure/ecr-repositories.sh
new file mode 100755
index 00000000..01dd458a
--- /dev/null
+++ b/walkthroughs/tls-with-acm/infrastructure/ecr-repositories.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+set -ex
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null && pwd )"
+
+aws --profile "${AWS_PROFILE}" --region "${AWS_DEFAULT_REGION}" \
+    cloudformation deploy \
+    --stack-name "${ENVIRONMENT_NAME}-ecr-repositories" \
+    --capabilities CAPABILITY_IAM \
+    --template-file "${DIR}/ecr-repositories.yaml"
diff --git a/walkthroughs/tls-with-acm/infrastructure/ecr-repositories.yaml b/walkthroughs/tls-with-acm/infrastructure/ecr-repositories.yaml
new file mode 100644
index 00000000..ee74fdd5
--- /dev/null
+++ b/walkthroughs/tls-with-acm/infrastructure/ecr-repositories.yaml
@@ -0,0 +1,10 @@
+Resources:
+  GatewayRepository:
+    Type: AWS::ECR::Repository
+    Properties:
+      RepositoryName: gateway
+
+  ColorTellerRepository:
+    Type: AWS::ECR::Repository
+    Properties:
+      RepositoryName: colorteller
diff --git a/walkthroughs/tls-with-acm/infrastructure/ecs-cluster.sh b/walkthroughs/tls-with-acm/infrastructure/ecs-cluster.sh
new file mode 100755
index 00000000..0af6b87d
--- /dev/null
+++ b/walkthroughs/tls-with-acm/infrastructure/ecs-cluster.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+set -ex 
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null && pwd )"
+
+aws --profile "${AWS_PROFILE}" --region "${AWS_DEFAULT_REGION}" \
+    cloudformation deploy \
+    --stack-name "${ENVIRONMENT_NAME}-ecs-cluster" \
+    --capabilities CAPABILITY_IAM \
+    --template-file "${DIR}/ecs-cluster.yaml"  \
+    --parameter-overrides \
+    EnvironmentName="${ENVIRONMENT_NAME}" \
+    KeyName="${KEY_PAIR_NAME}" \
+    ECSServicesDomain="${SERVICES_DOMAIN}"
diff --git a/walkthroughs/tls-with-acm/infrastructure/ecs-cluster.yaml b/walkthroughs/tls-with-acm/infrastructure/ecs-cluster.yaml
new file mode 100644
index 00000000..8648ad68
--- /dev/null
+++ b/walkthroughs/tls-with-acm/infrastructure/ecs-cluster.yaml
@@ -0,0 +1,177 @@
+Description: >
+  This template deploys an ECS cluster to the provided VPC and subnets
+  using an Auto Scaling Group
+
+Parameters:
+
+  EnvironmentName:
+    Description: An environment name that will be prefixed to resource names
+    Type: String
+
+  InstanceType:
+    Description: Which instance type should we use to build the ECS cluster?
+    Type: String
+    Default: c4.large
+
+  KeyName:
+    Description: The EC2 Key Pair to allow SSH access to the instances
+    Type: AWS::EC2::KeyPair::KeyName
+  
+  ECSServiceLogGroupRetentionInDays:
+    Type: Number
+    Default: 30
+
+  ECSServicesDomain:
+    Type: String
+    Description: "Domain name registerd under Route-53 that will be used for Service Discovery"
+
+  EC2Ami:
+    Description: EC2 AMI ID
+    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
+    Default: "/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2"
+
+Resources:
+
+  ECSCluster:
+    Type: AWS::ECS::Cluster
+    Properties:
+      ClusterName: !Ref EnvironmentName
+
+  ECSInstancesSecurityGroup:
+    Type: AWS::EC2::SecurityGroup
+    Properties: 
+      GroupDescription: "Security group for the instances"
+      VpcId:
+        'Fn::ImportValue': !Sub "${EnvironmentName}:VPC"
+      SecurityGroupIngress:
+        - CidrIp:
+            'Fn::ImportValue': !Sub "${EnvironmentName}:VpcCIDR"
+          IpProtocol: -1
+
+  ECSServiceSecurityGroup:
+    Type: AWS::EC2::SecurityGroup
+    Properties: 
+      GroupDescription: "Security group for the service"
+      VpcId:
+        'Fn::ImportValue': !Sub "${EnvironmentName}:VPC"
+      SecurityGroupIngress:
+        - CidrIp:
+            'Fn::ImportValue': !Sub "${EnvironmentName}:VpcCIDR"
+          IpProtocol: -1
+
+  TaskIamRole:
+    Type: AWS::IAM::Role
+    Properties:
+      Path: /
+      AssumeRolePolicyDocument: |
+        {
+            "Statement": [{
+                "Effect": "Allow",
+                "Principal": { "Service": [ "ecs-tasks.amazonaws.com" ]},
+                "Action": [ "sts:AssumeRole" ]
+            }]
+        }
+      ManagedPolicyArns:
+        - arn:aws:iam::aws:policy/CloudWatchFullAccess
+        - arn:aws:iam::aws:policy/AWSXRayDaemonWriteAccess
+        - arn:aws:iam::aws:policy/AWSAppMeshPreviewEnvoyAccess
+        - arn:aws:iam::aws:policy/AWSAppMeshEnvoyAccess
+
+  TaskExecutionIamRole:
+    Type: AWS::IAM::Role
+    Properties:
+      Path: /
+      AssumeRolePolicyDocument: |
+        {
+            "Statement": [{
+                "Effect": "Allow",
+                "Principal": { "Service": [ "ecs-tasks.amazonaws.com" ]},
+                "Action": [ "sts:AssumeRole" ]
+            }]
+        }
+      ManagedPolicyArns:
+        - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
+        - arn:aws:iam::aws:policy/CloudWatchLogsFullAccess
+
+  ECSServiceLogGroup:
+    Type: 'AWS::Logs::LogGroup'
+    Properties:
+      RetentionInDays:
+        Ref: ECSServiceLogGroupRetentionInDays
+
+  ECSServiceDiscoveryNamespace:
+    Type: AWS::ServiceDiscovery::PrivateDnsNamespace
+    Properties:
+      Vpc:
+        'Fn::ImportValue': !Sub "${EnvironmentName}:VPC"
+      Name: { Ref: ECSServicesDomain }
+
+  BastionSecurityGroup:
+    Type: AWS::EC2::SecurityGroup
+    Properties:
+      GroupDescription: Allow http to client host
+      VpcId: 
+        'Fn::ImportValue': !Sub "${EnvironmentName}:VPC"
+      SecurityGroupIngress:
+      - IpProtocol: tcp
+        FromPort: 22
+        ToPort: 22
+        CidrIp: 0.0.0.0/0
+
+  BastionHost:
+    Type: AWS::EC2::Instance
+    Properties: 
+      ImageId: !Ref EC2Ami
+      KeyName: !Ref KeyName
+      InstanceType: t2.micro
+      SecurityGroupIds:
+      - !Ref BastionSecurityGroup
+      SubnetId: 
+        'Fn::ImportValue': !Sub "${EnvironmentName}:PublicSubnet1"
+      Tags: 
+        - Key: Name
+          Value: bastion-host
+
+Outputs:
+
+  Cluster:
+    Description: A reference to the ECS cluster
+    Value: !Ref ECSCluster
+    Export:
+      Name: !Sub "${EnvironmentName}:ECSCluster"
+
+  ECSServiceDiscoveryNamespace:
+    Description: A SDS namespace that will be used by all services in this cluster
+    Value: !Ref ECSServiceDiscoveryNamespace
+    Export:
+      Name: !Sub "${EnvironmentName}:ECSServiceDiscoveryNamespace"
+
+  ECSServiceLogGroup:
+    Description: Log group for services to publish logs
+    Value: !Ref ECSServiceLogGroup
+    Export:
+      Name: !Sub "${EnvironmentName}:ECSServiceLogGroup"
+
+  ECSServiceSecurityGroup:
+    Description: Security group to be used by all services in the cluster
+    Value: !Ref ECSServiceSecurityGroup
+    Export:
+      Name: !Sub "${EnvironmentName}:ECSServiceSecurityGroup"
+
+  TaskExecutionIamRoleArn:
+    Description: Task Executin IAM role used by ECS tasks
+    Value: { "Fn::GetAtt": TaskExecutionIamRole.Arn }
+    Export:
+      Name: !Sub "${EnvironmentName}:TaskExecutionIamRoleArn"
+
+  TaskIamRoleArn:
+    Description: IAM role to be used by ECS task
+    Value: { "Fn::GetAtt": TaskIamRole.Arn }
+    Export:
+      Name: !Sub "${EnvironmentName}:TaskIamRoleArn"
+
+  BastionIP:
+    Description: Public IP for ssh access to bastion host
+    Value:
+      'Fn::GetAtt': [ BastionHost, PublicIp ]
+
diff --git a/walkthroughs/tls-with-acm/infrastructure/ecs-service.sh b/walkthroughs/tls-with-acm/infrastructure/ecs-service.sh
new file mode 100755
index 00000000..031a83ff
--- /dev/null
+++ b/walkthroughs/tls-with-acm/infrastructure/ecs-service.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+set -ex
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null && pwd )"
+
+aws --profile "${AWS_PROFILE}" --region "${AWS_DEFAULT_REGION}" \
+    cloudformation deploy \
+    --stack-name "${ENVIRONMENT_NAME}-ecs-service" \
+    --capabilities CAPABILITY_IAM \
+    --template-file "${DIR}/ecs-service.yaml"  \
+    --parameter-overrides \
+    EnvironmentName="${ENVIRONMENT_NAME}" \
+    ECSServicesDomain="${SERVICES_DOMAIN}" \
+    AppMeshMeshName="${MESH_NAME}"
diff --git a/walkthroughs/tls-with-acm/infrastructure/ecs-service.yaml b/walkthroughs/tls-with-acm/infrastructure/ecs-service.yaml
new file mode 100644
index 00000000..77123af4
--- /dev/null
+++ b/walkthroughs/tls-with-acm/infrastructure/ecs-service.yaml
@@ -0,0 +1,346 @@
+---
+Parameters:
+  EnvironmentName:
+    Type: String
+    Description: Environment name that joins all the stacks
+
+  AppMeshMeshName:
+    Type: String
+    Description: Name of mesh
+
+  ECSServicesDomain:
+    Type: String
+    Description: DNS namespace used by services e.g. default.svc.cluster.local
+
+  LoadBalancerPath:
+    Type: String
+    Default: "*"
+    Description: A path on the public load balancer that this service
+                 should be connected to. Use * to send all load balancer
+                 traffic to this service.
+
+Resources:
+
+
+  ### colorteller.default.svc.cluster.local
+  ColorTellerWhiteServiceDiscoveryRecord:
+    Type: 'AWS::ServiceDiscovery::Service'
+    Properties:
+      Name: "colorteller"
+      DnsConfig:
+        NamespaceId:
+          'Fn::ImportValue': !Sub "${EnvironmentName}:ECSServiceDiscoveryNamespace"
+        DnsRecords:
+          - Type: A
+            TTL: 300
+      HealthCheckCustomConfig:
+        FailureThreshold: 1
+
+  ColorTellerWhiteTaskDefinition:
+    Type: AWS::ECS::TaskDefinition
+    Properties:
+      RequiresCompatibilities:
+        - 'FARGATE'
+      Family: 'white'
+      NetworkMode: 'awsvpc'
+      Cpu: 256
+      Memory: 512
+      TaskRoleArn:
+        'Fn::ImportValue': !Sub "${EnvironmentName}:TaskIamRoleArn"
+      ExecutionRoleArn:
+        'Fn::ImportValue': !Sub "${EnvironmentName}:TaskExecutionIamRoleArn"
+      ProxyConfiguration:
+        Type: 'APPMESH'
+        ContainerName: 'envoy'
+        ProxyConfigurationProperties:
+          - Name: 'IgnoredUID'
+            Value: '1337'
+          - Name: 'ProxyIngressPort'
+            Value: '15000'
+          - Name: 'ProxyEgressPort'
+            Value: '15001'
+          - Name: 'AppPorts'
+            Value: '9080'
+          - Name: 'EgressIgnoredIPs'
+            Value: '169.254.170.2,169.254.169.254'
+      ContainerDefinitions:
+        - Name: 'app'
+          Image: !Sub '${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/colorteller'
+          Essential: true
+          DependsOn:
+            - ContainerName: 'envoy'
+              Condition: 'HEALTHY'
+          LogConfiguration:
+            LogDriver: 'awslogs'
+            Options:
+              awslogs-group:
+                Fn::ImportValue: !Sub "${EnvironmentName}:ECSServiceLogGroup"
+              awslogs-region: !Ref AWS::Region
+              awslogs-stream-prefix: 'white'
+          PortMappings:
+            - ContainerPort: 9080
+              Protocol: 'http'
+          Environment:
+            - Name: 'SERVER_PORT'
+              Value: 9080
+            - Name: 'COLOR'
+              Value: 'white'
+        - Name: envoy
+          Image: '111345817488.dkr.ecr.us-west-2.amazonaws.com/aws-appmesh-envoy:v1.9.1.0-prod'
+          Essential: true
+          User: '1337'
+          Ulimits:
+            - Name: "nofile"
+              HardLimit: 15000
+              SoftLimit: 15000
+          PortMappings:
+            - ContainerPort: 9901
+              Protocol: 'tcp'
+            - ContainerPort: 15000
+              Protocol: 'tcp'
+            - ContainerPort: 15001
+              Protocol: 'tcp'
+          HealthCheck:
+            Command:
+              - 'CMD-SHELL'
+              - 'curl -s http://localhost:9901/server_info | grep state | grep -q LIVE'
+            Interval: 5
+            Timeout: 2
+            Retries: 3
+          LogConfiguration:
+            LogDriver: 'awslogs'
+            Options:
+              awslogs-group:
+                Fn::ImportValue: !Sub "${EnvironmentName}:ECSServiceLogGroup"
+              awslogs-region: !Ref AWS::Region
+              awslogs-stream-prefix: 'white-envoy'
+          Environment:
+            - Name: 'APPMESH_VIRTUAL_NODE_NAME'
+              Value: !Sub 'mesh/${AppMeshMeshName}/virtualNode/colorteller-white-vn'
+            - Name: 'APPMESH_PREVIEW'
+              Value: '1'
+
+  ColorTellerWhiteService:
+    Type: 'AWS::ECS::Service'
+    Properties:
+      Cluster:
+        'Fn::ImportValue': !Sub "${EnvironmentName}:ECSCluster"
+      DeploymentConfiguration:
+        MaximumPercent: 200
+        MinimumHealthyPercent: 100
+      DesiredCount: 1
+      LaunchType: FARGATE
+      ServiceRegistries:
+        - RegistryArn:
+            'Fn::GetAtt': ColorTellerWhiteServiceDiscoveryRecord.Arn
+      NetworkConfiguration:
+        AwsvpcConfiguration:
+          AssignPublicIp: DISABLED
+          SecurityGroups:
+            - 'Fn::ImportValue': !Sub "${EnvironmentName}:ECSServiceSecurityGroup"
+          Subnets: 
+            - 'Fn::ImportValue': !Sub "${EnvironmentName}:PrivateSubnet1"
+            - 'Fn::ImportValue': !Sub "${EnvironmentName}:PrivateSubnet2"
+      TaskDefinition: { Ref: ColorTellerWhiteTaskDefinition }
+
+  ### colorgateway.default.svc.cluster.local
+  ColorGatewayServiceDiscoveryRecord:
+    Type: 'AWS::ServiceDiscovery::Service'
+    Properties:
+      Name: "colorgateway"
+      DnsConfig:
+        NamespaceId:
+          'Fn::ImportValue': !Sub "${EnvironmentName}:ECSServiceDiscoveryNamespace"
+        DnsRecords:
+          - Type: A
+            TTL: 300
+      HealthCheckCustomConfig:
+        FailureThreshold: 1
+
+  ColorGatewayTaskDefinition:
+    Type: AWS::ECS::TaskDefinition
+    Properties:
+      RequiresCompatibilities:
+        - 'FARGATE'
+      Family: 'gateway'
+      NetworkMode: 'awsvpc'
+      Cpu: 256
+      Memory: 512
+      TaskRoleArn:
+        'Fn::ImportValue': !Sub "${EnvironmentName}:TaskIamRoleArn"
+      ExecutionRoleArn:
+        'Fn::ImportValue': !Sub "${EnvironmentName}:TaskExecutionIamRoleArn"
+      ProxyConfiguration:
+        Type: 'APPMESH'
+        ContainerName: 'envoy'
+        ProxyConfigurationProperties:
+          - Name: 'IgnoredUID'
+            Value: '1337'
+          - Name: 'ProxyIngressPort'
+            Value: '15000'
+          - Name: 'ProxyEgressPort'
+            Value: '15001'
+          - Name: 'AppPorts'
+            Value: '9080'
+          - Name: 'EgressIgnoredIPs'
+            Value: '169.254.170.2,169.254.169.254'
+      ContainerDefinitions:
+        - Name: 'app'
+          Image: !Sub '${AWS::AccountId}.dkr.ecr.${AWS::Region}.amazonaws.com/gateway'
+          Essential: true
+          DependsOn:
+            - ContainerName: 'envoy'
+              Condition: 'HEALTHY'
+          LogConfiguration:
+            LogDriver: 'awslogs'
+            Options:
+              awslogs-group:
+                Fn::ImportValue: !Sub "${EnvironmentName}:ECSServiceLogGroup"
+              awslogs-region: !Ref AWS::Region
+              awslogs-stream-prefix: 'gateway'
+          PortMappings:
+            - ContainerPort: 9080
+              Protocol: 'http'
+          Environment:
+            - Name: SERVER_PORT
+              Value: 9080
+            - Name: COLOR_TELLER_ENDPOINT
+              Value: !Sub 'colorteller.${ECSServicesDomain}:9080'
+            - Name: TCP_ECHO_ENDPOINT
+              Value: unused
+        - Name: envoy
+          Image: '111345817488.dkr.ecr.us-west-2.amazonaws.com/aws-appmesh-envoy:v1.9.1.0-prod'
+          Essential: true
+          User: '1337'
+          Ulimits:
+            - Name: "nofile"
+              HardLimit: 15000
+              SoftLimit: 15000
+          PortMappings:
+            - ContainerPort: 9901
+              Protocol: 'tcp'
+            - ContainerPort: 15000
+              Protocol: 'tcp'
+            - ContainerPort: 15001
+              Protocol: 'tcp'
+          HealthCheck:
+            Command:
+              - 'CMD-SHELL'
+              - 'curl -s http://localhost:9901/server_info | grep state | grep -q LIVE'
+            Interval: 5
+            Timeout: 2
+            Retries: 3
+          LogConfiguration:
+            LogDriver: 'awslogs'
+            Options:
+              awslogs-group:
+                Fn::ImportValue: !Sub "${EnvironmentName}:ECSServiceLogGroup"
+              awslogs-region: !Ref AWS::Region
+              awslogs-stream-prefix: 'gateway-envoy'
+          Environment:
+            - Name: 'APPMESH_VIRTUAL_NODE_NAME'
+              Value: !Sub 'mesh/${AppMeshMeshName}/virtualNode/colorgateway-vn'
+            - Name: 'APPMESH_PREVIEW'
+              Value: '1'
+
+  ColorGatewayService:
+    Type: 'AWS::ECS::Service'
+    DependsOn:
+      - WebLoadBalancerRule
+    Properties:
+      Cluster:
+        'Fn::ImportValue': !Sub "${EnvironmentName}:ECSCluster"
+      DeploymentConfiguration:
+        MaximumPercent: 200
+        MinimumHealthyPercent: 100
+      DesiredCount: 1
+      LaunchType: FARGATE
+      ServiceRegistries:
+        - RegistryArn:
+            'Fn::GetAtt': ColorGatewayServiceDiscoveryRecord.Arn
+      NetworkConfiguration:
+        AwsvpcConfiguration:
+          AssignPublicIp: DISABLED
+          SecurityGroups:
+            - 'Fn::ImportValue': !Sub "${EnvironmentName}:ECSServiceSecurityGroup"
+          Subnets: 
+            - 'Fn::ImportValue': !Sub "${EnvironmentName}:PrivateSubnet1"
+            - 'Fn::ImportValue': !Sub "${EnvironmentName}:PrivateSubnet2"
+      TaskDefinition: { Ref: ColorGatewayTaskDefinition }
+      LoadBalancers:
+        - ContainerName: app
+          ContainerPort: 9080
+          TargetGroupArn: !Ref WebTargetGroup
+
+  PublicLoadBalancerSG:
+    Type: AWS::EC2::SecurityGroup
+    Properties:
+      GroupDescription: Access to the public facing load balancer
+      VpcId:
+        'Fn::ImportValue': !Sub "${EnvironmentName}:VPC"
+      SecurityGroupIngress:
+          - CidrIp: 0.0.0.0/0
+            IpProtocol: -1
+
+  # public ALB for color gateway
+  PublicLoadBalancer:
+    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
+    Properties:
+      Scheme: internet-facing
+      LoadBalancerAttributes:
+        - Key: idle_timeout.timeout_seconds
+          Value: '30'
+      Subnets:
+        - { 'Fn::ImportValue': !Sub "${EnvironmentName}:PublicSubnet1" }  
+        - { 'Fn::ImportValue': !Sub "${EnvironmentName}:PublicSubnet2" }  
+      SecurityGroups: [!Ref 'PublicLoadBalancerSG']
+
+  WebTargetGroup:
+    Type: AWS::ElasticLoadBalancingV2::TargetGroup
+    Properties:
+      HealthCheckIntervalSeconds: 6
+      HealthCheckPath: /ping
+      HealthCheckProtocol: HTTP
+      HealthCheckTimeoutSeconds: 5
+      HealthyThresholdCount: 2
+      TargetType: ip
+      Name: !Sub "${EnvironmentName}-web"
+      Port: 80
+      Protocol: HTTP
+      UnhealthyThresholdCount: 2
+      TargetGroupAttributes:
+        - Key: deregistration_delay.timeout_seconds
+          Value: 120
+      VpcId:
+        'Fn::ImportValue': !Sub "${EnvironmentName}:VPC"
+  
+  PublicLoadBalancerListener:
+    Type: AWS::ElasticLoadBalancingV2::Listener
+    DependsOn:
+      - PublicLoadBalancer
+    Properties:
+      DefaultActions:
+        - TargetGroupArn: !Ref WebTargetGroup
+          Type: 'forward'
+      LoadBalancerArn: !Ref 'PublicLoadBalancer'
+      Port: 80
+      Protocol: HTTP
+
+  WebLoadBalancerRule:
+    Type: AWS::ElasticLoadBalancingV2::ListenerRule
+    Properties:
+      Actions:
+        - TargetGroupArn: !Ref WebTargetGroup
+          Type: 'forward'
+      Conditions:
+        - Field: path-pattern
+          Values: [!Ref 'LoadBalancerPath']
+      ListenerArn: !Ref PublicLoadBalancerListener
+      Priority: 1
+
+Outputs: 
+
+  ColorAppEndpoint:
+    Description: Public endpoint for Color App service
+    Value: !Join ['', ['http://', !GetAtt 'PublicLoadBalancer.DNSName']]
+
diff --git a/walkthroughs/tls-with-acm/infrastructure/vpc.sh b/walkthroughs/tls-with-acm/infrastructure/vpc.sh
new file mode 100755
index 00000000..1a01628e
--- /dev/null
+++ b/walkthroughs/tls-with-acm/infrastructure/vpc.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+set -ex
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null && pwd )"
+
+aws --profile "${AWS_PROFILE}" --region "${AWS_DEFAULT_REGION}" \
+    cloudformation deploy \
+    --stack-name "${ENVIRONMENT_NAME}-vpc" \
+    --capabilities CAPABILITY_IAM \
+    --template-file "${DIR}/vpc.yaml" \
+    --parameter-overrides \
+    EnvironmentName="${ENVIRONMENT_NAME}"
diff --git a/walkthroughs/tls-with-acm/infrastructure/vpc.yaml b/walkthroughs/tls-with-acm/infrastructure/vpc.yaml
new file mode 100644
index 00000000..f5327b76
--- /dev/null
+++ b/walkthroughs/tls-with-acm/infrastructure/vpc.yaml
@@ -0,0 +1,241 @@
+Description: >
+  This template deploys a VPC, with a pair of public and private subnets spread 
+  across two Availabilty Zones. It deploys an Internet Gateway, with a default 
+  route on the public subnets. It deploys a pair of NAT Gateways (one in each AZ), 
+  and default routes for them in the private subnets.
+
+Parameters:
+
+  EnvironmentName:
+    Description: An environment name that will be prefixed to resource names
+    Type: String
+
+  VpcCIDR: 
+    Description: Please enter the IP range (CIDR notation) for this VPC
+    Type: String
+    Default: 10.0.0.0/16
+
+  PublicSubnet1CIDR:
+    Description: Please enter the IP range (CIDR notation) for the public subnet in the first Availability Zone
+    Type: String
+    Default: 10.0.0.0/19
+
+  PublicSubnet2CIDR:
+    Description: Please enter the IP range (CIDR notation) for the public subnet in the second Availability Zone
+    Type: String
+    Default: 10.0.32.0/19
+
+  PrivateSubnet1CIDR:
+    Description: Please enter the IP range (CIDR notation) for the private subnet in the first Availability Zone
+    Type: String
+    Default: 10.0.64.0/19
+
+  PrivateSubnet2CIDR:
+    Description: Please enter the IP range (CIDR notation) for the private subnet in the second Availability Zone
+    Type: String
+    Default: 10.0.96.0/19
+
+Resources:
+
+  VPC: 
+    Type: AWS::EC2::VPC
+    Properties:
+      CidrBlock: !Ref VpcCIDR
+      EnableDnsHostnames: true
+      Tags: 
+        - Key: Name 
+          Value: !Ref EnvironmentName
+      
+  InternetGateway:
+    Type: AWS::EC2::InternetGateway
+    Properties:
+      Tags:
+        - Key: Name
+          Value: !Ref EnvironmentName
+      
+  InternetGatewayAttachment:
+    Type: AWS::EC2::VPCGatewayAttachment
+    Properties:
+      InternetGatewayId: !Ref InternetGateway
+      VpcId: !Ref VPC
+
+  PublicSubnet1: 
+    Type: AWS::EC2::Subnet
+    Properties:
+      VpcId: !Ref VPC
+      AvailabilityZone: !Select [ 0, !GetAZs '' ]
+      CidrBlock: !Ref PublicSubnet1CIDR
+      MapPublicIpOnLaunch: true
+      Tags: 
+        - Key: Name 
+          Value: !Sub ${EnvironmentName} Public Subnet (AZ1)
+
+  PublicSubnet2: 
+    Type: AWS::EC2::Subnet
+    Properties:
+      VpcId: !Ref VPC
+      AvailabilityZone: !Select [ 1, !GetAZs '' ]
+      CidrBlock: !Ref PublicSubnet2CIDR
+      MapPublicIpOnLaunch: true
+      Tags: 
+        - Key: Name 
+          Value: !Sub ${EnvironmentName} Public Subnet (AZ2)
+
+  PrivateSubnet1: 
+    Type: AWS::EC2::Subnet
+    Properties:
+      VpcId: !Ref VPC
+      AvailabilityZone: !Select [ 0, !GetAZs '' ]
+      CidrBlock: !Ref PrivateSubnet1CIDR
+      MapPublicIpOnLaunch: false
+      Tags: 
+        - Key: Name 
+          Value: !Sub ${EnvironmentName} Private Subnet (AZ1)
+        - Key: "kubernetes.io/role/internal-elb"
+          Value: "1"
+
+  PrivateSubnet2: 
+    Type: AWS::EC2::Subnet
+    Properties:
+      VpcId: !Ref VPC
+      AvailabilityZone: !Select [ 1, !GetAZs '' ]
+      CidrBlock: !Ref PrivateSubnet2CIDR
+      MapPublicIpOnLaunch: false
+      Tags: 
+        - Key: Name 
+          Value: !Sub ${EnvironmentName} Private Subnet (AZ2)
+        - Key: "kubernetes.io/role/internal-elb"
+          Value: "1"
+
+  NatGateway1EIP:
+    Type: AWS::EC2::EIP
+    DependsOn: InternetGatewayAttachment
+    Properties: 
+      Domain: vpc
+
+  NatGateway2EIP:
+    Type: AWS::EC2::EIP
+    DependsOn: InternetGatewayAttachment
+    Properties:
+      Domain: vpc
+
+  NatGateway1: 
+    Type: AWS::EC2::NatGateway
+    Properties: 
+      AllocationId: !GetAtt NatGateway1EIP.AllocationId
+      SubnetId: !Ref PublicSubnet1
+
+  NatGateway2: 
+    Type: AWS::EC2::NatGateway
+    Properties:
+      AllocationId: !GetAtt NatGateway2EIP.AllocationId
+      SubnetId: !Ref PublicSubnet2
+
+  PublicRouteTable:
+    Type: AWS::EC2::RouteTable
+    Properties: 
+      VpcId: !Ref VPC
+      Tags: 
+        - Key: Name 
+          Value: !Sub ${EnvironmentName} Public Routes
+
+  DefaultPublicRoute: 
+    Type: AWS::EC2::Route
+    DependsOn: InternetGatewayAttachment
+    Properties: 
+      RouteTableId: !Ref PublicRouteTable
+      DestinationCidrBlock: 0.0.0.0/0
+      GatewayId: !Ref InternetGateway
+
+  PublicSubnet1RouteTableAssociation:
+    Type: AWS::EC2::SubnetRouteTableAssociation
+    Properties:
+      RouteTableId: !Ref PublicRouteTable
+      SubnetId: !Ref PublicSubnet1
+
+  PublicSubnet2RouteTableAssociation:
+    Type: AWS::EC2::SubnetRouteTableAssociation
+    Properties:
+      RouteTableId: !Ref PublicRouteTable
+      SubnetId: !Ref PublicSubnet2
+  
+  PrivateRouteTable1:
+    Type: AWS::EC2::RouteTable
+    Properties: 
+      VpcId: !Ref VPC
+      Tags: 
+        - Key: Name 
+          Value: !Sub ${EnvironmentName} Private Routes (AZ1)
+
+  DefaultPrivateRoute1:
+    Type: AWS::EC2::Route
+    Properties:
+      RouteTableId: !Ref PrivateRouteTable1
+      DestinationCidrBlock: 0.0.0.0/0
+      NatGatewayId: !Ref NatGateway1
+
+  PrivateSubnet1RouteTableAssociation:
+    Type: AWS::EC2::SubnetRouteTableAssociation
+    Properties:
+      RouteTableId: !Ref PrivateRouteTable1
+      SubnetId: !Ref PrivateSubnet1
+
+  PrivateRouteTable2:
+    Type: AWS::EC2::RouteTable
+    Properties: 
+      VpcId: !Ref VPC
+      Tags: 
+        - Key: Name 
+          Value: !Sub ${EnvironmentName} Private Routes (AZ2)
+
+  DefaultPrivateRoute2:
+    Type: AWS::EC2::Route
+    Properties:
+      RouteTableId: !Ref PrivateRouteTable2
+      DestinationCidrBlock: 0.0.0.0/0
+      NatGatewayId: !Ref NatGateway2
+
+  PrivateSubnet2RouteTableAssociation:
+    Type: AWS::EC2::SubnetRouteTableAssociation
+    Properties:
+      RouteTableId: !Ref PrivateRouteTable2
+      SubnetId: !Ref PrivateSubnet2
+
+Outputs: 
+
+  VPC: 
+    Description: A reference to the created VPC
+    Value: !Ref VPC
+    Export: 
+      Name: !Sub "${EnvironmentName}:VPC"
+
+  PublicSubnet1:
+    Description: A reference to the public subnet in the 1st Availability Zone
+    Value: !Ref PublicSubnet1
+    Export: 
+      Name: !Sub "${EnvironmentName}:PublicSubnet1"
+
+  PublicSubnet2: 
+    Description: A reference to the public subnet in the 2nd Availability Zone
+    Value: !Ref PublicSubnet2
+    Export: 
+      Name: !Sub "${EnvironmentName}:PublicSubnet2"
+
+  PrivateSubnet1:
+    Description: A reference to the private subnet in the 1st Availability Zone
+    Value: !Ref PrivateSubnet1
+    Export: 
+      Name: !Sub "${EnvironmentName}:PrivateSubnet1"
+
+  PrivateSubnet2: 
+    Description: A reference to the private subnet in the 2nd Availability Zone
+    Value: !Ref PrivateSubnet2
+    Export: 
+      Name: !Sub "${EnvironmentName}:PrivateSubnet2"
+
+  VpcCIDR:
+    Description: VPC CIDR
+    Value: !Ref VpcCIDR
+    Export:
+      Name: !Sub "${EnvironmentName}:VpcCIDR"
+
diff --git a/walkthroughs/tls-with-acm/mesh/colorgateway-vn.json b/walkthroughs/tls-with-acm/mesh/colorgateway-vn.json
new file mode 100644
index 00000000..5a506a64
--- /dev/null
+++ b/walkthroughs/tls-with-acm/mesh/colorgateway-vn.json
@@ -0,0 +1,20 @@
+{
+    "spec": {
+        "listeners": [
+            {
+                "portMapping": {
+                    "port": 9080,
+                    "protocol": "http"
+                }
+            }
+        ],
+        "serviceDiscovery": {
+            "dns": {
+                "hostname": $DNS_HOSTNAME
+            }
+        },
+        "backends": [
+            {"virtualService": {"virtualServiceName": $COLOR_TELLER_VS }}
+        ]
+    }
+}
\ No newline at end of file
diff --git a/walkthroughs/tls-with-acm/mesh/colorteller-route.json b/walkthroughs/tls-with-acm/mesh/colorteller-route.json
new file mode 100644
index 00000000..b794f2fa
--- /dev/null
+++ b/walkthroughs/tls-with-acm/mesh/colorteller-route.json
@@ -0,0 +1,17 @@
+{
+    "spec": {
+        "httpRoute": {
+            "action": {
+                "weightedTargets": [
+                    {
+                        "virtualNode": "colorteller-white-vn",
+                        "weight": 1
+                    }
+                ]
+            },
+            "match": {
+                "prefix": "/"
+            }
+        }
+    }
+}
diff --git a/walkthroughs/tls-with-acm/mesh/colorteller-vr.json b/walkthroughs/tls-with-acm/mesh/colorteller-vr.json
new file mode 100644
index 00000000..183d055b
--- /dev/null
+++ b/walkthroughs/tls-with-acm/mesh/colorteller-vr.json
@@ -0,0 +1,12 @@
+{
+    "spec": {
+        "listeners": [
+            {
+                "portMapping": {
+                    "port": 9080,
+                    "protocol": "http"
+                }
+            }
+        ]
+    }
+}
\ No newline at end of file
diff --git a/walkthroughs/tls-with-acm/mesh/colorteller-vs.json b/walkthroughs/tls-with-acm/mesh/colorteller-vs.json
new file mode 100644
index 00000000..e419c5de
--- /dev/null
+++ b/walkthroughs/tls-with-acm/mesh/colorteller-vs.json
@@ -0,0 +1,9 @@
+{
+    "spec": {
+        "provider": {
+            "virtualRouter": {
+                "virtualRouterName": "colorteller-vr"
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/walkthroughs/tls-with-acm/mesh/colorteller-white-vn.json b/walkthroughs/tls-with-acm/mesh/colorteller-white-vn.json
new file mode 100644
index 00000000..19e60ccb
--- /dev/null
+++ b/walkthroughs/tls-with-acm/mesh/colorteller-white-vn.json
@@ -0,0 +1,33 @@
+{
+    "spec": {
+        "listeners": [
+            {
+                "portMapping": {
+                    "port": 9080,
+                    "protocol": "http"
+                },
+                "healthCheck": {
+                    "protocol": "http",
+                    "path": "/ping",
+                    "healthyThreshold": 2,
+                    "unhealthyThreshold": 2,
+                    "timeoutMillis": 2000,
+                    "intervalMillis": 5000
+                },
+                "tls": {
+                    "mode": "STRICT",
+                    "certificate": {
+                        "acm": {
+                            "certificateArn": $CERTIFICATE_ARN
+                        }
+                    }
+                }
+            }
+        ],
+        "serviceDiscovery": {
+            "dns": {
+                "hostname": $DNS_HOSTNAME
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/walkthroughs/tls-with-acm/mesh/mesh.json b/walkthroughs/tls-with-acm/mesh/mesh.json
new file mode 100644
index 00000000..9e26dfee
--- /dev/null
+++ b/walkthroughs/tls-with-acm/mesh/mesh.json
@@ -0,0 +1 @@
+{}
\ No newline at end of file
diff --git a/walkthroughs/tls-with-acm/mesh/mesh.sh b/walkthroughs/tls-with-acm/mesh/mesh.sh
new file mode 100755
index 00000000..6fe8d15d
--- /dev/null
+++ b/walkthroughs/tls-with-acm/mesh/mesh.sh
@@ -0,0 +1,185 @@
+#!/usr/bin/env bash
+# vim:syn=sh:ts=4:sw=4:et:ai
+
+shopt -s nullglob
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null && pwd )"
+TEST_MESH_DIR="${DIR}"
+
+print() {
+    printf "[$(date)] : %s\n" "$*"
+}
+
+err() {
+    msg="Error: $1"
+    print "${msg}"
+    code=${2:-"1"}
+    exit ${code}
+}
+
+sanity_check() {
+    if [ -z "${MESH_NAME}" ]; then
+        err "MESH_NAME is not set"
+    fi
+}
+
+appmesh_cmd="aws appmesh-preview"
+
+create_mesh() {
+    spec_file=$1
+    cmd=( $appmesh_cmd create-mesh --mesh-name "${MESH_NAME}" \
+                ${PROFILE_OPT} \
+                --cli-input-json "file:///${spec_file}" \
+                --query mesh.metadata.uid --output text )
+    print "${cmd[@]}"
+    uid=$("${cmd[@]}") || err "Unable to create mesh" "$?"
+    print "--> ${uid}"
+}
+
+delete_mesh() {
+    cmd=( $appmesh_cmd delete-mesh --mesh-name "${MESH_NAME}" \
+                ${PROFILE_OPT} \
+                --query mesh.metadata.uid --output text )
+    print "${cmd[@]}"
+    uid=$("${cmd[@]}") || err "Unable to delete mesh" "$?"
+    print "--> ${uid}"
+}
+
+create_vnode() {
+    spec_file=$1
+    vnode_name=$2
+    dns_hostname="$3.${SERVICES_DOMAIN}"
+    cli_input=$( jq -n \
+        --arg CERTIFICATE_ARN "${CERTIFICATE_ARN}" \
+        --arg DNS_HOSTNAME "$3.${SERVICES_DOMAIN}" \
+        --arg COLOR_TELLER_VS "colorteller.${SERVICES_DOMAIN}" \
+        -f "$spec_file" )
+    cmd=( $appmesh_cmd create-virtual-node --mesh-name "${MESH_NAME}" \
+                --virtual-node-name "${vnode_name}" \
+                ${PROFILE_OPT} \
+                --cli-input-json "$cli_input" \
+                --query virtualNode.metadata.uid --output text )
+    print "${cmd[@]}"
+    uid=$("${cmd[@]}") || err "Unable to create virtual node" "$?"
+    print "--> ${uid}"
+}
+
+delete_vnode() {
+    vnode_name=$1
+    cmd=( $appmesh_cmd delete-virtual-node --mesh-name "${MESH_NAME}" \
+                --virtual-node-name "${vnode_name}" \
+                ${PROFILE_OPT} \
+                --query virtualNode.metadata.uid --output text )
+    print "${cmd[@]}"
+    uid=$("${cmd[@]}") || err "Unable to delete virtual node" "$?"
+    print "--> ${uid}"
+}
+
+create_vservice() {
+    spec_file=$1
+    vservice_name=$2
+    cmd=( $appmesh_cmd create-virtual-service --mesh-name "${MESH_NAME}" \
+                --virtual-service-name "${vservice_name}" \
+                ${PROFILE_OPT} \
+                --cli-input-json "file:///${spec_file}" \
+                --query virtualService.metadata.uid --output text )
+    print "${cmd[@]}"
+    uid=$("${cmd[@]}") || err "Unable to create virtual service" "$?"
+    print "--> ${uid}"
+}
+
+delete_vservice() {
+    vservice_name=$1
+    cmd=( $appmesh_cmd delete-virtual-service --mesh-name "${MESH_NAME}" \
+                --virtual-service-name "${vservice_name}" \
+                ${PROFILE_OPT} \
+                --query virtualService.metadata.uid --output text )
+    print "${cmd[@]}"
+    uid=$("${cmd[@]}") || err "Unable to delete virtual service" "$?"
+    print "--> ${uid}"
+}
+
+create_vrouter() {
+    spec_file=$1
+    vrouter_name=$2
+    cmd=( $appmesh_cmd create-virtual-router --mesh-name "${MESH_NAME}" \
+                --virtual-router-name "${vrouter_name}" \
+                ${PROFILE_OPT} \
+                --cli-input-json "file:///${spec_file}" \
+                --query virtualRouter.metadata.uid --output text )
+    print "${cmd[@]}"
+    uid=$("${cmd[@]}") || err "Unable to create virtual router" "$?"
+    print "--> ${uid}"
+}
+
+delete_vrouter() {
+    vrouter_name=$1
+    cmd=( $appmesh_cmd delete-virtual-router --mesh-name "${MESH_NAME}" \
+                --virtual-router-name "${vrouter_name}" \
+                ${PROFILE_OPT} \
+                --query virtualRouter.metadata.uid --output text )
+    print "${cmd[@]}"
+    uid=$("${cmd[@]}") || err "Unable to delete virtual router" "$?"
+    print "--> ${uid}"
+}
+
+create_route() {
+    spec_file=$1
+    vrouter_name=$2
+    route_name=$3
+    cmd=( $appmesh_cmd create-route --mesh-name "${MESH_NAME}" \
+                --virtual-router-name "${vrouter_name}" \
+                --route-name "${route_name}" \
+                ${PROFILE_OPT} \
+                --cli-input-json "file:///${spec_file}" \
+                --query route.metadata.uid --output text )
+    print "${cmd[@]}"
+    uid=$("${cmd[@]}") || err "Unable to create route" "$?"
+    print "--> ${uid}"
+}
+
+delete_route() {
+    vrouter_name=$1
+    route_name=$2
+    cmd=( $appmesh_cmd delete-route --mesh-name "${MESH_NAME}" \
+                --virtual-router-name "${vrouter_name}" \
+                --route-name "${route_name}" \
+                ${PROFILE_OPT} \
+                --query route.metadata.uid --output text )
+    print "${cmd[@]}"
+    uid=$("${cmd[@]}") || err "Unable to delete route" "$?"
+    print "--> ${uid}"
+}
+
+main() {
+    action="$1"
+    if [ -z "$action" ]; then
+        echo "Usage:"
+        echo "mesh.sh [up|down]"
+    fi
+    sanity_check
+
+    case "$action" in
+    up)
+        create_mesh "${TEST_MESH_DIR}/mesh.json"
+        create_vnode "${TEST_MESH_DIR}/colorgateway-vn.json" "colorgateway-vn" "colorgateway"
+        create_vnode "${TEST_MESH_DIR}/colorteller-white-vn.json" "colorteller-white-vn" "colorteller"
+        create_vrouter "${TEST_MESH_DIR}/colorteller-vr.json" "colorteller-vr"
+        create_route "${TEST_MESH_DIR}/colorteller-route.json" "colorteller-vr" "colorteller-route"
+        create_vservice "${TEST_MESH_DIR}/colorteller-vs.json" "colorteller.${SERVICES_DOMAIN}"
+        ;;
+    down)
+        delete_vservice "colorteller.${SERVICES_DOMAIN}"
+        delete_route "colorteller-vr" "colorteller-route"
+        delete_vrouter "colorteller-vr"
+        delete_vnode "colorgateway-vn"
+        delete_vnode "colorteller-white-vn"
+        delete_mesh
+        ;;
+    *)
+        err "Invalid action specified: $action"
+        ;;
+    esac
+}
+
+main $@
diff --git a/walkthroughs/tls-with-acm/src/colorteller/Dockerfile b/walkthroughs/tls-with-acm/src/colorteller/Dockerfile
new file mode 100644
index 00000000..fa5fcf5c
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/Dockerfile
@@ -0,0 +1,16 @@
+FROM golang:1.10 AS builder
+
+# Download and install the latest release of dep
+ADD https://github.com/golang/dep/releases/download/v0.4.1/dep-linux-amd64 /usr/bin/dep
+RUN chmod +x /usr/bin/dep
+
+# Copy the code from the host and compile it
+WORKDIR $GOPATH/src/github.com/username/repo
+COPY Gopkg.toml Gopkg.lock ./
+RUN dep ensure --vendor-only
+COPY . ./
+RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix nocgo -o /app .
+
+FROM scratch
+COPY --from=builder /app ./
+ENTRYPOINT ["./app"]
diff --git a/walkthroughs/tls-with-acm/src/colorteller/Gopkg.lock b/walkthroughs/tls-with-acm/src/colorteller/Gopkg.lock
new file mode 100644
index 00000000..4beff2df
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/Gopkg.lock
@@ -0,0 +1,73 @@
+# This file is autogenerated, do not edit; changes may be undone by the next 'dep ensure'.
+
+
+[[projects]]
+  digest = "1:1034326f8d61b0f29e48151b732a24052a223ec859b16dc23a607cb757e9a76b"
+  name = "github.com/aws/aws-sdk-go"
+  packages = [
+    "aws",
+    "aws/awserr",
+    "aws/awsutil",
+    "aws/client",
+    "aws/client/metadata",
+    "aws/corehandlers",
+    "aws/credentials",
+    "aws/ec2metadata",
+    "aws/endpoints",
+    "aws/request",
+    "internal/ini",
+    "internal/sdkio",
+    "internal/sdkrand",
+    "internal/sdkuri",
+    "internal/shareddefaults",
+  ]
+  pruneopts = "UT"
+  revision = "4a2b0831f1351f3ece1962805a88fcc667cedd3e"
+  version = "v1.19.0"
+
+[[projects]]
+  digest = "1:dff8fcd35d7119307681535224fe8834916426cd1b079c42e3b3a17f792348ed"
+  name = "github.com/aws/aws-xray-sdk-go"
+  packages = [
+    "header",
+    "internal/plugins",
+    "pattern",
+    "resources",
+    "strategy/ctxmissing",
+    "strategy/exception",
+    "strategy/sampling",
+    "xray",
+  ]
+  pruneopts = "UT"
+  revision = "32670489212454717deeafb8da5dbb1da0299749"
+  version = "v0.9.4"
+
+[[projects]]
+  digest = "1:50e893a85575fa48dc4982a279e50e2fd8b74e4f7c587860c1e25c77083b8125"
+  name = "github.com/cihub/seelog"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "d2c6e5aa9fbfdd1c624e140287063c7730654115"
+  version = "v2.6"
+
+[[projects]]
+  digest = "1:bb81097a5b62634f3e9fec1014657855610c82d19b9a40c17612e32651e35dca"
+  name = "github.com/jmespath/go-jmespath"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "c2b33e84"
+
+[[projects]]
+  digest = "1:cf31692c14422fa27c83a05292eb5cbe0fb2775972e8f1f8446a71549bd8980b"
+  name = "github.com/pkg/errors"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "ba968bfe8b2f7e042a574c888954fccecfa385b4"
+  version = "v0.8.1"
+
+[solve-meta]
+  analyzer-name = "dep"
+  analyzer-version = 1
+  input-imports = ["github.com/aws/aws-xray-sdk-go/xray"]
+  solver-name = "gps-cdcl"
+  solver-version = 1
diff --git a/walkthroughs/tls-with-acm/src/colorteller/Gopkg.toml b/walkthroughs/tls-with-acm/src/colorteller/Gopkg.toml
new file mode 100644
index 00000000..d7072c22
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/Gopkg.toml
@@ -0,0 +1,30 @@
+# Gopkg.toml example
+#
+# Refer to https://golang.github.io/dep/docs/Gopkg.toml.html
+# for detailed Gopkg.toml documentation.
+#
+# required = ["github.com/user/thing/cmd/thing"]
+# ignored = ["github.com/user/project/pkgX", "bitbucket.org/user/project/pkgA/pkgY"]
+#
+# [[constraint]]
+#   name = "github.com/user/project"
+#   version = "1.0.0"
+#
+# [[constraint]]
+#   name = "github.com/user/project2"
+#   branch = "dev"
+#   source = "github.com/myfork/project2"
+#
+# [[override]]
+#   name = "github.com/x/y"
+#   version = "2.4.0"
+#
+# [prune]
+#   non-go = false
+#   go-tests = true
+#   unused-packages = true
+
+
+[prune]
+  go-tests = true
+  unused-packages = true
diff --git a/walkthroughs/tls-with-acm/src/colorteller/deploy.sh b/walkthroughs/tls-with-acm/src/colorteller/deploy.sh
new file mode 100755
index 00000000..5ed80d09
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/deploy.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# vim:syn=sh:ts=4:sw=4:et:ai
+
+set -ex
+
+if [ -z $COLOR_TELLER_IMAGE ]; then
+    echo "COLOR_TELLER_IMAGE environment variable is not set"
+    exit 1
+fi
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null && pwd )"
+
+# build
+docker build -t $COLOR_TELLER_IMAGE $DIR
+
+# push
+$(aws ecr get-login --no-include-email --region $AWS_DEFAULT_REGION)
+docker push $COLOR_TELLER_IMAGE
diff --git a/walkthroughs/tls-with-acm/src/colorteller/main.go b/walkthroughs/tls-with-acm/src/colorteller/main.go
new file mode 100644
index 00000000..14dae9d2
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/main.go
@@ -0,0 +1,61 @@
+package main
+
+import (
+	"fmt"
+	"log"
+	"net/http"
+	"os"
+
+	"github.com/aws/aws-xray-sdk-go/xray"
+)
+
+const defaultPort = "8080"
+const defaultColor = "black"
+const defaultStage = "default"
+
+func getServerPort() string {
+	port := os.Getenv("SERVER_PORT")
+	if port != "" {
+		return port
+	}
+
+	return defaultPort
+}
+
+func getColor() string {
+	color := os.Getenv("COLOR")
+	if color != "" {
+		return color
+	}
+
+	return defaultColor
+}
+
+func getStage() string {
+	stage := os.Getenv("STAGE")
+	if stage != "" {
+		return stage
+	}
+
+	return defaultStage
+}
+
+type colorHandler struct{}
+func (h *colorHandler) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
+	log.Println("color requested, responding with", getColor())
+	fmt.Fprint(writer, getColor())
+}
+
+type pingHandler struct{}
+func (h *pingHandler) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
+	log.Println("ping requested, reponding with HTTP 200")
+	writer.WriteHeader(http.StatusOK)
+}
+
+func main() {
+	log.Println("starting server, listening on port " + getServerPort())
+	xraySegmentNamer := xray.NewFixedSegmentNamer(fmt.Sprintf("%s-colorteller-%s", getStage(), getColor()))
+	http.Handle("/", xray.Handler(xraySegmentNamer, &colorHandler{}))
+	http.Handle("/ping", xray.Handler(xraySegmentNamer, &pingHandler{}))
+	http.ListenAndServe(":"+getServerPort(), nil)
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/LICENSE.txt b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/LICENSE.txt
new file mode 100644
index 00000000..d6456956
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/LICENSE.txt
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/NOTICE.txt b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/NOTICE.txt
new file mode 100644
index 00000000..899129ec
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/NOTICE.txt
@@ -0,0 +1,3 @@
+AWS SDK for Go
+Copyright 2015 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+Copyright 2014-2015 Stripe, Inc.
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/awserr/error.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/awserr/error.go
new file mode 100644
index 00000000..56fdfc2b
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/awserr/error.go
@@ -0,0 +1,145 @@
+// Package awserr represents API error interface accessors for the SDK.
+package awserr
+
+// An Error wraps lower level errors with code, message and an original error.
+// The underlying concrete error type may also satisfy other interfaces which
+// can be to used to obtain more specific information about the error.
+//
+// Calling Error() or String() will always include the full information about
+// an error based on its underlying type.
+//
+// Example:
+//
+//     output, err := s3manage.Upload(svc, input, opts)
+//     if err != nil {
+//         if awsErr, ok := err.(awserr.Error); ok {
+//             // Get error details
+//             log.Println("Error:", awsErr.Code(), awsErr.Message())
+//
+//             // Prints out full error message, including original error if there was one.
+//             log.Println("Error:", awsErr.Error())
+//
+//             // Get original error
+//             if origErr := awsErr.OrigErr(); origErr != nil {
+//                 // operate on original error.
+//             }
+//         } else {
+//             fmt.Println(err.Error())
+//         }
+//     }
+//
+type Error interface {
+	// Satisfy the generic error interface.
+	error
+
+	// Returns the short phrase depicting the classification of the error.
+	Code() string
+
+	// Returns the error details message.
+	Message() string
+
+	// Returns the original error if one was set.  Nil is returned if not set.
+	OrigErr() error
+}
+
+// BatchError is a batch of errors which also wraps lower level errors with
+// code, message, and original errors. Calling Error() will include all errors
+// that occurred in the batch.
+//
+// Deprecated: Replaced with BatchedErrors. Only defined for backwards
+// compatibility.
+type BatchError interface {
+	// Satisfy the generic error interface.
+	error
+
+	// Returns the short phrase depicting the classification of the error.
+	Code() string
+
+	// Returns the error details message.
+	Message() string
+
+	// Returns the original error if one was set.  Nil is returned if not set.
+	OrigErrs() []error
+}
+
+// BatchedErrors is a batch of errors which also wraps lower level errors with
+// code, message, and original errors. Calling Error() will include all errors
+// that occurred in the batch.
+//
+// Replaces BatchError
+type BatchedErrors interface {
+	// Satisfy the base Error interface.
+	Error
+
+	// Returns the original error if one was set.  Nil is returned if not set.
+	OrigErrs() []error
+}
+
+// New returns an Error object described by the code, message, and origErr.
+//
+// If origErr satisfies the Error interface it will not be wrapped within a new
+// Error object and will instead be returned.
+func New(code, message string, origErr error) Error {
+	var errs []error
+	if origErr != nil {
+		errs = append(errs, origErr)
+	}
+	return newBaseError(code, message, errs)
+}
+
+// NewBatchError returns an BatchedErrors with a collection of errors as an
+// array of errors.
+func NewBatchError(code, message string, errs []error) BatchedErrors {
+	return newBaseError(code, message, errs)
+}
+
+// A RequestFailure is an interface to extract request failure information from
+// an Error such as the request ID of the failed request returned by a service.
+// RequestFailures may not always have a requestID value if the request failed
+// prior to reaching the service such as a connection error.
+//
+// Example:
+//
+//     output, err := s3manage.Upload(svc, input, opts)
+//     if err != nil {
+//         if reqerr, ok := err.(RequestFailure); ok {
+//             log.Println("Request failed", reqerr.Code(), reqerr.Message(), reqerr.RequestID())
+//         } else {
+//             log.Println("Error:", err.Error())
+//         }
+//     }
+//
+// Combined with awserr.Error:
+//
+//    output, err := s3manage.Upload(svc, input, opts)
+//    if err != nil {
+//        if awsErr, ok := err.(awserr.Error); ok {
+//            // Generic AWS Error with Code, Message, and original error (if any)
+//            fmt.Println(awsErr.Code(), awsErr.Message(), awsErr.OrigErr())
+//
+//            if reqErr, ok := err.(awserr.RequestFailure); ok {
+//                // A service error occurred
+//                fmt.Println(reqErr.StatusCode(), reqErr.RequestID())
+//            }
+//        } else {
+//            fmt.Println(err.Error())
+//        }
+//    }
+//
+type RequestFailure interface {
+	Error
+
+	// The status code of the HTTP response.
+	StatusCode() int
+
+	// The request ID returned by the service for a request failure. This will
+	// be empty if no request ID is available such as the request failed due
+	// to a connection error.
+	RequestID() string
+}
+
+// NewRequestFailure returns a new request error wrapper for the given Error
+// provided.
+func NewRequestFailure(err Error, statusCode int, reqID string) RequestFailure {
+	return newRequestError(err, statusCode, reqID)
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/awserr/types.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/awserr/types.go
new file mode 100644
index 00000000..0202a008
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/awserr/types.go
@@ -0,0 +1,194 @@
+package awserr
+
+import "fmt"
+
+// SprintError returns a string of the formatted error code.
+//
+// Both extra and origErr are optional.  If they are included their lines
+// will be added, but if they are not included their lines will be ignored.
+func SprintError(code, message, extra string, origErr error) string {
+	msg := fmt.Sprintf("%s: %s", code, message)
+	if extra != "" {
+		msg = fmt.Sprintf("%s\n\t%s", msg, extra)
+	}
+	if origErr != nil {
+		msg = fmt.Sprintf("%s\ncaused by: %s", msg, origErr.Error())
+	}
+	return msg
+}
+
+// A baseError wraps the code and message which defines an error. It also
+// can be used to wrap an original error object.
+//
+// Should be used as the root for errors satisfying the awserr.Error. Also
+// for any error which does not fit into a specific error wrapper type.
+type baseError struct {
+	// Classification of error
+	code string
+
+	// Detailed information about error
+	message string
+
+	// Optional original error this error is based off of. Allows building
+	// chained errors.
+	errs []error
+}
+
+// newBaseError returns an error object for the code, message, and errors.
+//
+// code is a short no whitespace phrase depicting the classification of
+// the error that is being created.
+//
+// message is the free flow string containing detailed information about the
+// error.
+//
+// origErrs is the error objects which will be nested under the new errors to
+// be returned.
+func newBaseError(code, message string, origErrs []error) *baseError {
+	b := &baseError{
+		code:    code,
+		message: message,
+		errs:    origErrs,
+	}
+
+	return b
+}
+
+// Error returns the string representation of the error.
+//
+// See ErrorWithExtra for formatting.
+//
+// Satisfies the error interface.
+func (b baseError) Error() string {
+	size := len(b.errs)
+	if size > 0 {
+		return SprintError(b.code, b.message, "", errorList(b.errs))
+	}
+
+	return SprintError(b.code, b.message, "", nil)
+}
+
+// String returns the string representation of the error.
+// Alias for Error to satisfy the stringer interface.
+func (b baseError) String() string {
+	return b.Error()
+}
+
+// Code returns the short phrase depicting the classification of the error.
+func (b baseError) Code() string {
+	return b.code
+}
+
+// Message returns the error details message.
+func (b baseError) Message() string {
+	return b.message
+}
+
+// OrigErr returns the original error if one was set. Nil is returned if no
+// error was set. This only returns the first element in the list. If the full
+// list is needed, use BatchedErrors.
+func (b baseError) OrigErr() error {
+	switch len(b.errs) {
+	case 0:
+		return nil
+	case 1:
+		return b.errs[0]
+	default:
+		if err, ok := b.errs[0].(Error); ok {
+			return NewBatchError(err.Code(), err.Message(), b.errs[1:])
+		}
+		return NewBatchError("BatchedErrors",
+			"multiple errors occurred", b.errs)
+	}
+}
+
+// OrigErrs returns the original errors if one was set. An empty slice is
+// returned if no error was set.
+func (b baseError) OrigErrs() []error {
+	return b.errs
+}
+
+// So that the Error interface type can be included as an anonymous field
+// in the requestError struct and not conflict with the error.Error() method.
+type awsError Error
+
+// A requestError wraps a request or service error.
+//
+// Composed of baseError for code, message, and original error.
+type requestError struct {
+	awsError
+	statusCode int
+	requestID  string
+}
+
+// newRequestError returns a wrapped error with additional information for
+// request status code, and service requestID.
+//
+// Should be used to wrap all request which involve service requests. Even if
+// the request failed without a service response, but had an HTTP status code
+// that may be meaningful.
+//
+// Also wraps original errors via the baseError.
+func newRequestError(err Error, statusCode int, requestID string) *requestError {
+	return &requestError{
+		awsError:   err,
+		statusCode: statusCode,
+		requestID:  requestID,
+	}
+}
+
+// Error returns the string representation of the error.
+// Satisfies the error interface.
+func (r requestError) Error() string {
+	extra := fmt.Sprintf("status code: %d, request id: %s",
+		r.statusCode, r.requestID)
+	return SprintError(r.Code(), r.Message(), extra, r.OrigErr())
+}
+
+// String returns the string representation of the error.
+// Alias for Error to satisfy the stringer interface.
+func (r requestError) String() string {
+	return r.Error()
+}
+
+// StatusCode returns the wrapped status code for the error
+func (r requestError) StatusCode() int {
+	return r.statusCode
+}
+
+// RequestID returns the wrapped requestID
+func (r requestError) RequestID() string {
+	return r.requestID
+}
+
+// OrigErrs returns the original errors if one was set. An empty slice is
+// returned if no error was set.
+func (r requestError) OrigErrs() []error {
+	if b, ok := r.awsError.(BatchedErrors); ok {
+		return b.OrigErrs()
+	}
+	return []error{r.OrigErr()}
+}
+
+// An error list that satisfies the golang interface
+type errorList []error
+
+// Error returns the string representation of the error.
+//
+// Satisfies the error interface.
+func (e errorList) Error() string {
+	msg := ""
+	// How do we want to handle the array size being zero
+	if size := len(e); size > 0 {
+		for i := 0; i < size; i++ {
+			msg += fmt.Sprintf("%s", e[i].Error())
+			// We check the next index to see if it is within the slice.
+			// If it is, then we append a newline. We do this, because unit tests
+			// could be broken with the additional '\n'
+			if i+1 < size {
+				msg += "\n"
+			}
+		}
+	}
+	return msg
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/awsutil/copy.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/awsutil/copy.go
new file mode 100644
index 00000000..1a3d106d
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/awsutil/copy.go
@@ -0,0 +1,108 @@
+package awsutil
+
+import (
+	"io"
+	"reflect"
+	"time"
+)
+
+// Copy deeply copies a src structure to dst. Useful for copying request and
+// response structures.
+//
+// Can copy between structs of different type, but will only copy fields which
+// are assignable, and exist in both structs. Fields which are not assignable,
+// or do not exist in both structs are ignored.
+func Copy(dst, src interface{}) {
+	dstval := reflect.ValueOf(dst)
+	if !dstval.IsValid() {
+		panic("Copy dst cannot be nil")
+	}
+
+	rcopy(dstval, reflect.ValueOf(src), true)
+}
+
+// CopyOf returns a copy of src while also allocating the memory for dst.
+// src must be a pointer type or this operation will fail.
+func CopyOf(src interface{}) (dst interface{}) {
+	dsti := reflect.New(reflect.TypeOf(src).Elem())
+	dst = dsti.Interface()
+	rcopy(dsti, reflect.ValueOf(src), true)
+	return
+}
+
+// rcopy performs a recursive copy of values from the source to destination.
+//
+// root is used to skip certain aspects of the copy which are not valid
+// for the root node of a object.
+func rcopy(dst, src reflect.Value, root bool) {
+	if !src.IsValid() {
+		return
+	}
+
+	switch src.Kind() {
+	case reflect.Ptr:
+		if _, ok := src.Interface().(io.Reader); ok {
+			if dst.Kind() == reflect.Ptr && dst.Elem().CanSet() {
+				dst.Elem().Set(src)
+			} else if dst.CanSet() {
+				dst.Set(src)
+			}
+		} else {
+			e := src.Type().Elem()
+			if dst.CanSet() && !src.IsNil() {
+				if _, ok := src.Interface().(*time.Time); !ok {
+					dst.Set(reflect.New(e))
+				} else {
+					tempValue := reflect.New(e)
+					tempValue.Elem().Set(src.Elem())
+					// Sets time.Time's unexported values
+					dst.Set(tempValue)
+				}
+			}
+			if src.Elem().IsValid() {
+				// Keep the current root state since the depth hasn't changed
+				rcopy(dst.Elem(), src.Elem(), root)
+			}
+		}
+	case reflect.Struct:
+		t := dst.Type()
+		for i := 0; i < t.NumField(); i++ {
+			name := t.Field(i).Name
+			srcVal := src.FieldByName(name)
+			dstVal := dst.FieldByName(name)
+			if srcVal.IsValid() && dstVal.CanSet() {
+				rcopy(dstVal, srcVal, false)
+			}
+		}
+	case reflect.Slice:
+		if src.IsNil() {
+			break
+		}
+
+		s := reflect.MakeSlice(src.Type(), src.Len(), src.Cap())
+		dst.Set(s)
+		for i := 0; i < src.Len(); i++ {
+			rcopy(dst.Index(i), src.Index(i), false)
+		}
+	case reflect.Map:
+		if src.IsNil() {
+			break
+		}
+
+		s := reflect.MakeMap(src.Type())
+		dst.Set(s)
+		for _, k := range src.MapKeys() {
+			v := src.MapIndex(k)
+			v2 := reflect.New(v.Type()).Elem()
+			rcopy(v2, v, false)
+			dst.SetMapIndex(k, v2)
+		}
+	default:
+		// Assign the value if possible. If its not assignable, the value would
+		// need to be converted and the impact of that may be unexpected, or is
+		// not compatible with the dst type.
+		if src.Type().AssignableTo(dst.Type()) {
+			dst.Set(src)
+		}
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/awsutil/equal.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/awsutil/equal.go
new file mode 100644
index 00000000..59fa4a55
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/awsutil/equal.go
@@ -0,0 +1,27 @@
+package awsutil
+
+import (
+	"reflect"
+)
+
+// DeepEqual returns if the two values are deeply equal like reflect.DeepEqual.
+// In addition to this, this method will also dereference the input values if
+// possible so the DeepEqual performed will not fail if one parameter is a
+// pointer and the other is not.
+//
+// DeepEqual will not perform indirection of nested values of the input parameters.
+func DeepEqual(a, b interface{}) bool {
+	ra := reflect.Indirect(reflect.ValueOf(a))
+	rb := reflect.Indirect(reflect.ValueOf(b))
+
+	if raValid, rbValid := ra.IsValid(), rb.IsValid(); !raValid && !rbValid {
+		// If the elements are both nil, and of the same type the are equal
+		// If they are of different types they are not equal
+		return reflect.TypeOf(a) == reflect.TypeOf(b)
+	} else if raValid != rbValid {
+		// Both values must be valid to be equal
+		return false
+	}
+
+	return reflect.DeepEqual(ra.Interface(), rb.Interface())
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/awsutil/path_value.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/awsutil/path_value.go
new file mode 100644
index 00000000..11c52c38
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/awsutil/path_value.go
@@ -0,0 +1,222 @@
+package awsutil
+
+import (
+	"reflect"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"github.com/jmespath/go-jmespath"
+)
+
+var indexRe = regexp.MustCompile(`(.+)\[(-?\d+)?\]$`)
+
+// rValuesAtPath returns a slice of values found in value v. The values
+// in v are explored recursively so all nested values are collected.
+func rValuesAtPath(v interface{}, path string, createPath, caseSensitive, nilTerm bool) []reflect.Value {
+	pathparts := strings.Split(path, "||")
+	if len(pathparts) > 1 {
+		for _, pathpart := range pathparts {
+			vals := rValuesAtPath(v, pathpart, createPath, caseSensitive, nilTerm)
+			if len(vals) > 0 {
+				return vals
+			}
+		}
+		return nil
+	}
+
+	values := []reflect.Value{reflect.Indirect(reflect.ValueOf(v))}
+	components := strings.Split(path, ".")
+	for len(values) > 0 && len(components) > 0 {
+		var index *int64
+		var indexStar bool
+		c := strings.TrimSpace(components[0])
+		if c == "" { // no actual component, illegal syntax
+			return nil
+		} else if caseSensitive && c != "*" && strings.ToLower(c[0:1]) == c[0:1] {
+			// TODO normalize case for user
+			return nil // don't support unexported fields
+		}
+
+		// parse this component
+		if m := indexRe.FindStringSubmatch(c); m != nil {
+			c = m[1]
+			if m[2] == "" {
+				index = nil
+				indexStar = true
+			} else {
+				i, _ := strconv.ParseInt(m[2], 10, 32)
+				index = &i
+				indexStar = false
+			}
+		}
+
+		nextvals := []reflect.Value{}
+		for _, value := range values {
+			// pull component name out of struct member
+			if value.Kind() != reflect.Struct {
+				continue
+			}
+
+			if c == "*" { // pull all members
+				for i := 0; i < value.NumField(); i++ {
+					if f := reflect.Indirect(value.Field(i)); f.IsValid() {
+						nextvals = append(nextvals, f)
+					}
+				}
+				continue
+			}
+
+			value = value.FieldByNameFunc(func(name string) bool {
+				if c == name {
+					return true
+				} else if !caseSensitive && strings.ToLower(name) == strings.ToLower(c) {
+					return true
+				}
+				return false
+			})
+
+			if nilTerm && value.Kind() == reflect.Ptr && len(components[1:]) == 0 {
+				if !value.IsNil() {
+					value.Set(reflect.Zero(value.Type()))
+				}
+				return []reflect.Value{value}
+			}
+
+			if createPath && value.Kind() == reflect.Ptr && value.IsNil() {
+				// TODO if the value is the terminus it should not be created
+				// if the value to be set to its position is nil.
+				value.Set(reflect.New(value.Type().Elem()))
+				value = value.Elem()
+			} else {
+				value = reflect.Indirect(value)
+			}
+
+			if value.Kind() == reflect.Slice || value.Kind() == reflect.Map {
+				if !createPath && value.IsNil() {
+					value = reflect.ValueOf(nil)
+				}
+			}
+
+			if value.IsValid() {
+				nextvals = append(nextvals, value)
+			}
+		}
+		values = nextvals
+
+		if indexStar || index != nil {
+			nextvals = []reflect.Value{}
+			for _, valItem := range values {
+				value := reflect.Indirect(valItem)
+				if value.Kind() != reflect.Slice {
+					continue
+				}
+
+				if indexStar { // grab all indices
+					for i := 0; i < value.Len(); i++ {
+						idx := reflect.Indirect(value.Index(i))
+						if idx.IsValid() {
+							nextvals = append(nextvals, idx)
+						}
+					}
+					continue
+				}
+
+				// pull out index
+				i := int(*index)
+				if i >= value.Len() { // check out of bounds
+					if createPath {
+						// TODO resize slice
+					} else {
+						continue
+					}
+				} else if i < 0 { // support negative indexing
+					i = value.Len() + i
+				}
+				value = reflect.Indirect(value.Index(i))
+
+				if value.Kind() == reflect.Slice || value.Kind() == reflect.Map {
+					if !createPath && value.IsNil() {
+						value = reflect.ValueOf(nil)
+					}
+				}
+
+				if value.IsValid() {
+					nextvals = append(nextvals, value)
+				}
+			}
+			values = nextvals
+		}
+
+		components = components[1:]
+	}
+	return values
+}
+
+// ValuesAtPath returns a list of values at the case insensitive lexical
+// path inside of a structure.
+func ValuesAtPath(i interface{}, path string) ([]interface{}, error) {
+	result, err := jmespath.Search(path, i)
+	if err != nil {
+		return nil, err
+	}
+
+	v := reflect.ValueOf(result)
+	if !v.IsValid() || (v.Kind() == reflect.Ptr && v.IsNil()) {
+		return nil, nil
+	}
+	if s, ok := result.([]interface{}); ok {
+		return s, err
+	}
+	if v.Kind() == reflect.Map && v.Len() == 0 {
+		return nil, nil
+	}
+	if v.Kind() == reflect.Slice {
+		out := make([]interface{}, v.Len())
+		for i := 0; i < v.Len(); i++ {
+			out[i] = v.Index(i).Interface()
+		}
+		return out, nil
+	}
+
+	return []interface{}{result}, nil
+}
+
+// SetValueAtPath sets a value at the case insensitive lexical path inside
+// of a structure.
+func SetValueAtPath(i interface{}, path string, v interface{}) {
+	if rvals := rValuesAtPath(i, path, true, false, v == nil); rvals != nil {
+		for _, rval := range rvals {
+			if rval.Kind() == reflect.Ptr && rval.IsNil() {
+				continue
+			}
+			setValue(rval, v)
+		}
+	}
+}
+
+func setValue(dstVal reflect.Value, src interface{}) {
+	if dstVal.Kind() == reflect.Ptr {
+		dstVal = reflect.Indirect(dstVal)
+	}
+	srcVal := reflect.ValueOf(src)
+
+	if !srcVal.IsValid() { // src is literal nil
+		if dstVal.CanAddr() {
+			// Convert to pointer so that pointer's value can be nil'ed
+			//                     dstVal = dstVal.Addr()
+		}
+		dstVal.Set(reflect.Zero(dstVal.Type()))
+
+	} else if srcVal.Kind() == reflect.Ptr {
+		if srcVal.IsNil() {
+			srcVal = reflect.Zero(dstVal.Type())
+		} else {
+			srcVal = reflect.ValueOf(src).Elem()
+		}
+		dstVal.Set(srcVal)
+	} else {
+		dstVal.Set(srcVal)
+	}
+
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/awsutil/prettify.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/awsutil/prettify.go
new file mode 100644
index 00000000..710eb432
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/awsutil/prettify.go
@@ -0,0 +1,113 @@
+package awsutil
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"reflect"
+	"strings"
+)
+
+// Prettify returns the string representation of a value.
+func Prettify(i interface{}) string {
+	var buf bytes.Buffer
+	prettify(reflect.ValueOf(i), 0, &buf)
+	return buf.String()
+}
+
+// prettify will recursively walk value v to build a textual
+// representation of the value.
+func prettify(v reflect.Value, indent int, buf *bytes.Buffer) {
+	for v.Kind() == reflect.Ptr {
+		v = v.Elem()
+	}
+
+	switch v.Kind() {
+	case reflect.Struct:
+		strtype := v.Type().String()
+		if strtype == "time.Time" {
+			fmt.Fprintf(buf, "%s", v.Interface())
+			break
+		} else if strings.HasPrefix(strtype, "io.") {
+			buf.WriteString("<buffer>")
+			break
+		}
+
+		buf.WriteString("{\n")
+
+		names := []string{}
+		for i := 0; i < v.Type().NumField(); i++ {
+			name := v.Type().Field(i).Name
+			f := v.Field(i)
+			if name[0:1] == strings.ToLower(name[0:1]) {
+				continue // ignore unexported fields
+			}
+			if (f.Kind() == reflect.Ptr || f.Kind() == reflect.Slice || f.Kind() == reflect.Map) && f.IsNil() {
+				continue // ignore unset fields
+			}
+			names = append(names, name)
+		}
+
+		for i, n := range names {
+			val := v.FieldByName(n)
+			buf.WriteString(strings.Repeat(" ", indent+2))
+			buf.WriteString(n + ": ")
+			prettify(val, indent+2, buf)
+
+			if i < len(names)-1 {
+				buf.WriteString(",\n")
+			}
+		}
+
+		buf.WriteString("\n" + strings.Repeat(" ", indent) + "}")
+	case reflect.Slice:
+		strtype := v.Type().String()
+		if strtype == "[]uint8" {
+			fmt.Fprintf(buf, "<binary> len %d", v.Len())
+			break
+		}
+
+		nl, id, id2 := "", "", ""
+		if v.Len() > 3 {
+			nl, id, id2 = "\n", strings.Repeat(" ", indent), strings.Repeat(" ", indent+2)
+		}
+		buf.WriteString("[" + nl)
+		for i := 0; i < v.Len(); i++ {
+			buf.WriteString(id2)
+			prettify(v.Index(i), indent+2, buf)
+
+			if i < v.Len()-1 {
+				buf.WriteString("," + nl)
+			}
+		}
+
+		buf.WriteString(nl + id + "]")
+	case reflect.Map:
+		buf.WriteString("{\n")
+
+		for i, k := range v.MapKeys() {
+			buf.WriteString(strings.Repeat(" ", indent+2))
+			buf.WriteString(k.String() + ": ")
+			prettify(v.MapIndex(k), indent+2, buf)
+
+			if i < v.Len()-1 {
+				buf.WriteString(",\n")
+			}
+		}
+
+		buf.WriteString("\n" + strings.Repeat(" ", indent) + "}")
+	default:
+		if !v.IsValid() {
+			fmt.Fprint(buf, "<invalid value>")
+			return
+		}
+		format := "%v"
+		switch v.Interface().(type) {
+		case string:
+			format = "%q"
+		case io.ReadSeeker, io.Reader:
+			format = "buffer(%p)"
+		}
+		fmt.Fprintf(buf, format, v.Interface())
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/awsutil/string_value.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/awsutil/string_value.go
new file mode 100644
index 00000000..645df245
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/awsutil/string_value.go
@@ -0,0 +1,88 @@
+package awsutil
+
+import (
+	"bytes"
+	"fmt"
+	"reflect"
+	"strings"
+)
+
+// StringValue returns the string representation of a value.
+func StringValue(i interface{}) string {
+	var buf bytes.Buffer
+	stringValue(reflect.ValueOf(i), 0, &buf)
+	return buf.String()
+}
+
+func stringValue(v reflect.Value, indent int, buf *bytes.Buffer) {
+	for v.Kind() == reflect.Ptr {
+		v = v.Elem()
+	}
+
+	switch v.Kind() {
+	case reflect.Struct:
+		buf.WriteString("{\n")
+
+		for i := 0; i < v.Type().NumField(); i++ {
+			ft := v.Type().Field(i)
+			fv := v.Field(i)
+
+			if ft.Name[0:1] == strings.ToLower(ft.Name[0:1]) {
+				continue // ignore unexported fields
+			}
+			if (fv.Kind() == reflect.Ptr || fv.Kind() == reflect.Slice) && fv.IsNil() {
+				continue // ignore unset fields
+			}
+
+			buf.WriteString(strings.Repeat(" ", indent+2))
+			buf.WriteString(ft.Name + ": ")
+
+			if tag := ft.Tag.Get("sensitive"); tag == "true" {
+				buf.WriteString("<sensitive>")
+			} else {
+				stringValue(fv, indent+2, buf)
+			}
+
+			buf.WriteString(",\n")
+		}
+
+		buf.WriteString("\n" + strings.Repeat(" ", indent) + "}")
+	case reflect.Slice:
+		nl, id, id2 := "", "", ""
+		if v.Len() > 3 {
+			nl, id, id2 = "\n", strings.Repeat(" ", indent), strings.Repeat(" ", indent+2)
+		}
+		buf.WriteString("[" + nl)
+		for i := 0; i < v.Len(); i++ {
+			buf.WriteString(id2)
+			stringValue(v.Index(i), indent+2, buf)
+
+			if i < v.Len()-1 {
+				buf.WriteString("," + nl)
+			}
+		}
+
+		buf.WriteString(nl + id + "]")
+	case reflect.Map:
+		buf.WriteString("{\n")
+
+		for i, k := range v.MapKeys() {
+			buf.WriteString(strings.Repeat(" ", indent+2))
+			buf.WriteString(k.String() + ": ")
+			stringValue(v.MapIndex(k), indent+2, buf)
+
+			if i < v.Len()-1 {
+				buf.WriteString(",\n")
+			}
+		}
+
+		buf.WriteString("\n" + strings.Repeat(" ", indent) + "}")
+	default:
+		format := "%v"
+		switch v.Interface().(type) {
+		case string:
+			format = "%q"
+		}
+		fmt.Fprintf(buf, format, v.Interface())
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/client/client.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/client/client.go
new file mode 100644
index 00000000..70960538
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/client/client.go
@@ -0,0 +1,96 @@
+package client
+
+import (
+	"fmt"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/client/metadata"
+	"github.com/aws/aws-sdk-go/aws/request"
+)
+
+// A Config provides configuration to a service client instance.
+type Config struct {
+	Config        *aws.Config
+	Handlers      request.Handlers
+	Endpoint      string
+	SigningRegion string
+	SigningName   string
+
+	// States that the signing name did not come from a modeled source but
+	// was derived based on other data. Used by service client constructors
+	// to determine if the signin name can be overridden based on metadata the
+	// service has.
+	SigningNameDerived bool
+}
+
+// ConfigProvider provides a generic way for a service client to receive
+// the ClientConfig without circular dependencies.
+type ConfigProvider interface {
+	ClientConfig(serviceName string, cfgs ...*aws.Config) Config
+}
+
+// ConfigNoResolveEndpointProvider same as ConfigProvider except it will not
+// resolve the endpoint automatically. The service client's endpoint must be
+// provided via the aws.Config.Endpoint field.
+type ConfigNoResolveEndpointProvider interface {
+	ClientConfigNoResolveEndpoint(cfgs ...*aws.Config) Config
+}
+
+// A Client implements the base client request and response handling
+// used by all service clients.
+type Client struct {
+	request.Retryer
+	metadata.ClientInfo
+
+	Config   aws.Config
+	Handlers request.Handlers
+}
+
+// New will return a pointer to a new initialized service client.
+func New(cfg aws.Config, info metadata.ClientInfo, handlers request.Handlers, options ...func(*Client)) *Client {
+	svc := &Client{
+		Config:     cfg,
+		ClientInfo: info,
+		Handlers:   handlers.Copy(),
+	}
+
+	switch retryer, ok := cfg.Retryer.(request.Retryer); {
+	case ok:
+		svc.Retryer = retryer
+	case cfg.Retryer != nil && cfg.Logger != nil:
+		s := fmt.Sprintf("WARNING: %T does not implement request.Retryer; using DefaultRetryer instead", cfg.Retryer)
+		cfg.Logger.Log(s)
+		fallthrough
+	default:
+		maxRetries := aws.IntValue(cfg.MaxRetries)
+		if cfg.MaxRetries == nil || maxRetries == aws.UseServiceDefaultRetries {
+			maxRetries = 3
+		}
+		svc.Retryer = DefaultRetryer{NumMaxRetries: maxRetries}
+	}
+
+	svc.AddDebugHandlers()
+
+	for _, option := range options {
+		option(svc)
+	}
+
+	return svc
+}
+
+// NewRequest returns a new Request pointer for the service API
+// operation and parameters.
+func (c *Client) NewRequest(operation *request.Operation, params interface{}, data interface{}) *request.Request {
+	return request.New(c.Config, c.ClientInfo, c.Handlers, c.Retryer, operation, params, data)
+}
+
+// AddDebugHandlers injects debug logging handlers into the service to log request
+// debug information.
+func (c *Client) AddDebugHandlers() {
+	if !c.Config.LogLevel.AtLeast(aws.LogDebug) {
+		return
+	}
+
+	c.Handlers.Send.PushFrontNamed(LogHTTPRequestHandler)
+	c.Handlers.Send.PushBackNamed(LogHTTPResponseHandler)
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/client/default_retryer.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/client/default_retryer.go
new file mode 100644
index 00000000..a397b0d0
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/client/default_retryer.go
@@ -0,0 +1,116 @@
+package client
+
+import (
+	"strconv"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws/request"
+	"github.com/aws/aws-sdk-go/internal/sdkrand"
+)
+
+// DefaultRetryer implements basic retry logic using exponential backoff for
+// most services. If you want to implement custom retry logic, implement the
+// request.Retryer interface or create a structure type that composes this
+// struct and override the specific methods. For example, to override only
+// the MaxRetries method:
+//
+//		type retryer struct {
+//      client.DefaultRetryer
+//    }
+//
+//    // This implementation always has 100 max retries
+//    func (d retryer) MaxRetries() int { return 100 }
+type DefaultRetryer struct {
+	NumMaxRetries int
+}
+
+// MaxRetries returns the number of maximum returns the service will use to make
+// an individual API request.
+func (d DefaultRetryer) MaxRetries() int {
+	return d.NumMaxRetries
+}
+
+// RetryRules returns the delay duration before retrying this request again
+func (d DefaultRetryer) RetryRules(r *request.Request) time.Duration {
+	// Set the upper limit of delay in retrying at ~five minutes
+	minTime := 30
+	throttle := d.shouldThrottle(r)
+	if throttle {
+		if delay, ok := getRetryDelay(r); ok {
+			return delay
+		}
+
+		minTime = 500
+	}
+
+	retryCount := r.RetryCount
+	if throttle && retryCount > 8 {
+		retryCount = 8
+	} else if retryCount > 13 {
+		retryCount = 13
+	}
+
+	delay := (1 << uint(retryCount)) * (sdkrand.SeededRand.Intn(minTime) + minTime)
+	return time.Duration(delay) * time.Millisecond
+}
+
+// ShouldRetry returns true if the request should be retried.
+func (d DefaultRetryer) ShouldRetry(r *request.Request) bool {
+	// If one of the other handlers already set the retry state
+	// we don't want to override it based on the service's state
+	if r.Retryable != nil {
+		return *r.Retryable
+	}
+
+	if r.HTTPResponse.StatusCode >= 500 && r.HTTPResponse.StatusCode != 501 {
+		return true
+	}
+	return r.IsErrorRetryable() || d.shouldThrottle(r)
+}
+
+// ShouldThrottle returns true if the request should be throttled.
+func (d DefaultRetryer) shouldThrottle(r *request.Request) bool {
+	switch r.HTTPResponse.StatusCode {
+	case 429:
+	case 502:
+	case 503:
+	case 504:
+	default:
+		return r.IsErrorThrottle()
+	}
+
+	return true
+}
+
+// This will look in the Retry-After header, RFC 7231, for how long
+// it will wait before attempting another request
+func getRetryDelay(r *request.Request) (time.Duration, bool) {
+	if !canUseRetryAfterHeader(r) {
+		return 0, false
+	}
+
+	delayStr := r.HTTPResponse.Header.Get("Retry-After")
+	if len(delayStr) == 0 {
+		return 0, false
+	}
+
+	delay, err := strconv.Atoi(delayStr)
+	if err != nil {
+		return 0, false
+	}
+
+	return time.Duration(delay) * time.Second, true
+}
+
+// Will look at the status code to see if the retry header pertains to
+// the status code.
+func canUseRetryAfterHeader(r *request.Request) bool {
+	switch r.HTTPResponse.StatusCode {
+	case 429:
+	case 503:
+	default:
+		return false
+	}
+
+	return true
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/client/logger.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/client/logger.go
new file mode 100644
index 00000000..7b5e1276
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/client/logger.go
@@ -0,0 +1,190 @@
+package client
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"net/http/httputil"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/request"
+)
+
+const logReqMsg = `DEBUG: Request %s/%s Details:
+---[ REQUEST POST-SIGN ]-----------------------------
+%s
+-----------------------------------------------------`
+
+const logReqErrMsg = `DEBUG ERROR: Request %s/%s:
+---[ REQUEST DUMP ERROR ]-----------------------------
+%s
+------------------------------------------------------`
+
+type logWriter struct {
+	// Logger is what we will use to log the payload of a response.
+	Logger aws.Logger
+	// buf stores the contents of what has been read
+	buf *bytes.Buffer
+}
+
+func (logger *logWriter) Write(b []byte) (int, error) {
+	return logger.buf.Write(b)
+}
+
+type teeReaderCloser struct {
+	// io.Reader will be a tee reader that is used during logging.
+	// This structure will read from a body and write the contents to a logger.
+	io.Reader
+	// Source is used just to close when we are done reading.
+	Source io.ReadCloser
+}
+
+func (reader *teeReaderCloser) Close() error {
+	return reader.Source.Close()
+}
+
+// LogHTTPRequestHandler is a SDK request handler to log the HTTP request sent
+// to a service. Will include the HTTP request body if the LogLevel of the
+// request matches LogDebugWithHTTPBody.
+var LogHTTPRequestHandler = request.NamedHandler{
+	Name: "awssdk.client.LogRequest",
+	Fn:   logRequest,
+}
+
+func logRequest(r *request.Request) {
+	logBody := r.Config.LogLevel.Matches(aws.LogDebugWithHTTPBody)
+	bodySeekable := aws.IsReaderSeekable(r.Body)
+
+	b, err := httputil.DumpRequestOut(r.HTTPRequest, logBody)
+	if err != nil {
+		r.Config.Logger.Log(fmt.Sprintf(logReqErrMsg,
+			r.ClientInfo.ServiceName, r.Operation.Name, err))
+		return
+	}
+
+	if logBody {
+		if !bodySeekable {
+			r.SetReaderBody(aws.ReadSeekCloser(r.HTTPRequest.Body))
+		}
+		// Reset the request body because dumpRequest will re-wrap the r.HTTPRequest's
+		// Body as a NoOpCloser and will not be reset after read by the HTTP
+		// client reader.
+		r.ResetBody()
+	}
+
+	r.Config.Logger.Log(fmt.Sprintf(logReqMsg,
+		r.ClientInfo.ServiceName, r.Operation.Name, string(b)))
+}
+
+// LogHTTPRequestHeaderHandler is a SDK request handler to log the HTTP request sent
+// to a service. Will only log the HTTP request's headers. The request payload
+// will not be read.
+var LogHTTPRequestHeaderHandler = request.NamedHandler{
+	Name: "awssdk.client.LogRequestHeader",
+	Fn:   logRequestHeader,
+}
+
+func logRequestHeader(r *request.Request) {
+	b, err := httputil.DumpRequestOut(r.HTTPRequest, false)
+	if err != nil {
+		r.Config.Logger.Log(fmt.Sprintf(logReqErrMsg,
+			r.ClientInfo.ServiceName, r.Operation.Name, err))
+		return
+	}
+
+	r.Config.Logger.Log(fmt.Sprintf(logReqMsg,
+		r.ClientInfo.ServiceName, r.Operation.Name, string(b)))
+}
+
+const logRespMsg = `DEBUG: Response %s/%s Details:
+---[ RESPONSE ]--------------------------------------
+%s
+-----------------------------------------------------`
+
+const logRespErrMsg = `DEBUG ERROR: Response %s/%s:
+---[ RESPONSE DUMP ERROR ]-----------------------------
+%s
+-----------------------------------------------------`
+
+// LogHTTPResponseHandler is a SDK request handler to log the HTTP response
+// received from a service. Will include the HTTP response body if the LogLevel
+// of the request matches LogDebugWithHTTPBody.
+var LogHTTPResponseHandler = request.NamedHandler{
+	Name: "awssdk.client.LogResponse",
+	Fn:   logResponse,
+}
+
+func logResponse(r *request.Request) {
+	lw := &logWriter{r.Config.Logger, bytes.NewBuffer(nil)}
+
+	if r.HTTPResponse == nil {
+		lw.Logger.Log(fmt.Sprintf(logRespErrMsg,
+			r.ClientInfo.ServiceName, r.Operation.Name, "request's HTTPResponse is nil"))
+		return
+	}
+
+	logBody := r.Config.LogLevel.Matches(aws.LogDebugWithHTTPBody)
+	if logBody {
+		r.HTTPResponse.Body = &teeReaderCloser{
+			Reader: io.TeeReader(r.HTTPResponse.Body, lw),
+			Source: r.HTTPResponse.Body,
+		}
+	}
+
+	handlerFn := func(req *request.Request) {
+		b, err := httputil.DumpResponse(req.HTTPResponse, false)
+		if err != nil {
+			lw.Logger.Log(fmt.Sprintf(logRespErrMsg,
+				req.ClientInfo.ServiceName, req.Operation.Name, err))
+			return
+		}
+
+		lw.Logger.Log(fmt.Sprintf(logRespMsg,
+			req.ClientInfo.ServiceName, req.Operation.Name, string(b)))
+
+		if logBody {
+			b, err := ioutil.ReadAll(lw.buf)
+			if err != nil {
+				lw.Logger.Log(fmt.Sprintf(logRespErrMsg,
+					req.ClientInfo.ServiceName, req.Operation.Name, err))
+				return
+			}
+
+			lw.Logger.Log(string(b))
+		}
+	}
+
+	const handlerName = "awsdk.client.LogResponse.ResponseBody"
+
+	r.Handlers.Unmarshal.SetBackNamed(request.NamedHandler{
+		Name: handlerName, Fn: handlerFn,
+	})
+	r.Handlers.UnmarshalError.SetBackNamed(request.NamedHandler{
+		Name: handlerName, Fn: handlerFn,
+	})
+}
+
+// LogHTTPResponseHeaderHandler is a SDK request handler to log the HTTP
+// response received from a service. Will only log the HTTP response's headers.
+// The response payload will not be read.
+var LogHTTPResponseHeaderHandler = request.NamedHandler{
+	Name: "awssdk.client.LogResponseHeader",
+	Fn:   logResponseHeader,
+}
+
+func logResponseHeader(r *request.Request) {
+	if r.Config.Logger == nil {
+		return
+	}
+
+	b, err := httputil.DumpResponse(r.HTTPResponse, false)
+	if err != nil {
+		r.Config.Logger.Log(fmt.Sprintf(logRespErrMsg,
+			r.ClientInfo.ServiceName, r.Operation.Name, err))
+		return
+	}
+
+	r.Config.Logger.Log(fmt.Sprintf(logRespMsg,
+		r.ClientInfo.ServiceName, r.Operation.Name, string(b)))
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/client/metadata/client_info.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/client/metadata/client_info.go
new file mode 100644
index 00000000..920e9fdd
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/client/metadata/client_info.go
@@ -0,0 +1,13 @@
+package metadata
+
+// ClientInfo wraps immutable data from the client.Client structure.
+type ClientInfo struct {
+	ServiceName   string
+	ServiceID     string
+	APIVersion    string
+	Endpoint      string
+	SigningName   string
+	SigningRegion string
+	JSONVersion   string
+	TargetPrefix  string
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/config.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/config.go
new file mode 100644
index 00000000..10634d17
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/config.go
@@ -0,0 +1,536 @@
+package aws
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws/credentials"
+	"github.com/aws/aws-sdk-go/aws/endpoints"
+)
+
+// UseServiceDefaultRetries instructs the config to use the service's own
+// default number of retries. This will be the default action if
+// Config.MaxRetries is nil also.
+const UseServiceDefaultRetries = -1
+
+// RequestRetryer is an alias for a type that implements the request.Retryer
+// interface.
+type RequestRetryer interface{}
+
+// A Config provides service configuration for service clients. By default,
+// all clients will use the defaults.DefaultConfig structure.
+//
+//     // Create Session with MaxRetry configuration to be shared by multiple
+//     // service clients.
+//     sess := session.Must(session.NewSession(&aws.Config{
+//         MaxRetries: aws.Int(3),
+//     }))
+//
+//     // Create S3 service client with a specific Region.
+//     svc := s3.New(sess, &aws.Config{
+//         Region: aws.String("us-west-2"),
+//     })
+type Config struct {
+	// Enables verbose error printing of all credential chain errors.
+	// Should be used when wanting to see all errors while attempting to
+	// retrieve credentials.
+	CredentialsChainVerboseErrors *bool
+
+	// The credentials object to use when signing requests. Defaults to a
+	// chain of credential providers to search for credentials in environment
+	// variables, shared credential file, and EC2 Instance Roles.
+	Credentials *credentials.Credentials
+
+	// An optional endpoint URL (hostname only or fully qualified URI)
+	// that overrides the default generated endpoint for a client. Set this
+	// to `""` to use the default generated endpoint.
+	//
+	// Note: You must still provide a `Region` value when specifying an
+	// endpoint for a client.
+	Endpoint *string
+
+	// The resolver to use for looking up endpoints for AWS service clients
+	// to use based on region.
+	EndpointResolver endpoints.Resolver
+
+	// EnforceShouldRetryCheck is used in the AfterRetryHandler to always call
+	// ShouldRetry regardless of whether or not if request.Retryable is set.
+	// This will utilize ShouldRetry method of custom retryers. If EnforceShouldRetryCheck
+	// is not set, then ShouldRetry will only be called if request.Retryable is nil.
+	// Proper handling of the request.Retryable field is important when setting this field.
+	EnforceShouldRetryCheck *bool
+
+	// The region to send requests to. This parameter is required and must
+	// be configured globally or on a per-client basis unless otherwise
+	// noted. A full list of regions is found in the "Regions and Endpoints"
+	// document.
+	//
+	// See http://docs.aws.amazon.com/general/latest/gr/rande.html for AWS
+	// Regions and Endpoints.
+	Region *string
+
+	// Set this to `true` to disable SSL when sending requests. Defaults
+	// to `false`.
+	DisableSSL *bool
+
+	// The HTTP client to use when sending requests. Defaults to
+	// `http.DefaultClient`.
+	HTTPClient *http.Client
+
+	// An integer value representing the logging level. The default log level
+	// is zero (LogOff), which represents no logging. To enable logging set
+	// to a LogLevel Value.
+	LogLevel *LogLevelType
+
+	// The logger writer interface to write logging messages to. Defaults to
+	// standard out.
+	Logger Logger
+
+	// The maximum number of times that a request will be retried for failures.
+	// Defaults to -1, which defers the max retry setting to the service
+	// specific configuration.
+	MaxRetries *int
+
+	// Retryer guides how HTTP requests should be retried in case of
+	// recoverable failures.
+	//
+	// When nil or the value does not implement the request.Retryer interface,
+	// the client.DefaultRetryer will be used.
+	//
+	// When both Retryer and MaxRetries are non-nil, the former is used and
+	// the latter ignored.
+	//
+	// To set the Retryer field in a type-safe manner and with chaining, use
+	// the request.WithRetryer helper function:
+	//
+	//   cfg := request.WithRetryer(aws.NewConfig(), myRetryer)
+	//
+	Retryer RequestRetryer
+
+	// Disables semantic parameter validation, which validates input for
+	// missing required fields and/or other semantic request input errors.
+	DisableParamValidation *bool
+
+	// Disables the computation of request and response checksums, e.g.,
+	// CRC32 checksums in Amazon DynamoDB.
+	DisableComputeChecksums *bool
+
+	// Set this to `true` to force the request to use path-style addressing,
+	// i.e., `http://s3.amazonaws.com/BUCKET/KEY`. By default, the S3 client
+	// will use virtual hosted bucket addressing when possible
+	// (`http://BUCKET.s3.amazonaws.com/KEY`).
+	//
+	// Note: This configuration option is specific to the Amazon S3 service.
+	//
+	// See http://docs.aws.amazon.com/AmazonS3/latest/dev/VirtualHosting.html
+	// for Amazon S3: Virtual Hosting of Buckets
+	S3ForcePathStyle *bool
+
+	// Set this to `true` to disable the SDK adding the `Expect: 100-Continue`
+	// header to PUT requests over 2MB of content. 100-Continue instructs the
+	// HTTP client not to send the body until the service responds with a
+	// `continue` status. This is useful to prevent sending the request body
+	// until after the request is authenticated, and validated.
+	//
+	// http://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectPUT.html
+	//
+	// 100-Continue is only enabled for Go 1.6 and above. See `http.Transport`'s
+	// `ExpectContinueTimeout` for information on adjusting the continue wait
+	// timeout. https://golang.org/pkg/net/http/#Transport
+	//
+	// You should use this flag to disble 100-Continue if you experience issues
+	// with proxies or third party S3 compatible services.
+	S3Disable100Continue *bool
+
+	// Set this to `true` to enable S3 Accelerate feature. For all operations
+	// compatible with S3 Accelerate will use the accelerate endpoint for
+	// requests. Requests not compatible will fall back to normal S3 requests.
+	//
+	// The bucket must be enable for accelerate to be used with S3 client with
+	// accelerate enabled. If the bucket is not enabled for accelerate an error
+	// will be returned. The bucket name must be DNS compatible to also work
+	// with accelerate.
+	S3UseAccelerate *bool
+
+	// S3DisableContentMD5Validation config option is temporarily disabled,
+	// For S3 GetObject API calls, #1837.
+	//
+	// Set this to `true` to disable the S3 service client from automatically
+	// adding the ContentMD5 to S3 Object Put and Upload API calls. This option
+	// will also disable the SDK from performing object ContentMD5 validation
+	// on GetObject API calls.
+	S3DisableContentMD5Validation *bool
+
+	// Set this to `true` to disable the EC2Metadata client from overriding the
+	// default http.Client's Timeout. This is helpful if you do not want the
+	// EC2Metadata client to create a new http.Client. This options is only
+	// meaningful if you're not already using a custom HTTP client with the
+	// SDK. Enabled by default.
+	//
+	// Must be set and provided to the session.NewSession() in order to disable
+	// the EC2Metadata overriding the timeout for default credentials chain.
+	//
+	// Example:
+	//    sess := session.Must(session.NewSession(aws.NewConfig()
+	//       .WithEC2MetadataDiableTimeoutOverride(true)))
+	//
+	//    svc := s3.New(sess)
+	//
+	EC2MetadataDisableTimeoutOverride *bool
+
+	// Instructs the endpoint to be generated for a service client to
+	// be the dual stack endpoint. The dual stack endpoint will support
+	// both IPv4 and IPv6 addressing.
+	//
+	// Setting this for a service which does not support dual stack will fail
+	// to make requets. It is not recommended to set this value on the session
+	// as it will apply to all service clients created with the session. Even
+	// services which don't support dual stack endpoints.
+	//
+	// If the Endpoint config value is also provided the UseDualStack flag
+	// will be ignored.
+	//
+	// Only supported with.
+	//
+	//     sess := session.Must(session.NewSession())
+	//
+	//     svc := s3.New(sess, &aws.Config{
+	//         UseDualStack: aws.Bool(true),
+	//     })
+	UseDualStack *bool
+
+	// SleepDelay is an override for the func the SDK will call when sleeping
+	// during the lifecycle of a request. Specifically this will be used for
+	// request delays. This value should only be used for testing. To adjust
+	// the delay of a request see the aws/client.DefaultRetryer and
+	// aws/request.Retryer.
+	//
+	// SleepDelay will prevent any Context from being used for canceling retry
+	// delay of an API operation. It is recommended to not use SleepDelay at all
+	// and specify a Retryer instead.
+	SleepDelay func(time.Duration)
+
+	// DisableRestProtocolURICleaning will not clean the URL path when making rest protocol requests.
+	// Will default to false. This would only be used for empty directory names in s3 requests.
+	//
+	// Example:
+	//    sess := session.Must(session.NewSession(&aws.Config{
+	//         DisableRestProtocolURICleaning: aws.Bool(true),
+	//    }))
+	//
+	//    svc := s3.New(sess)
+	//    out, err := svc.GetObject(&s3.GetObjectInput {
+	//    	Bucket: aws.String("bucketname"),
+	//    	Key: aws.String("//foo//bar//moo"),
+	//    })
+	DisableRestProtocolURICleaning *bool
+
+	// EnableEndpointDiscovery will allow for endpoint discovery on operations that
+	// have the definition in its model. By default, endpoint discovery is off.
+	//
+	// Example:
+	//    sess := session.Must(session.NewSession(&aws.Config{
+	//         EnableEndpointDiscovery: aws.Bool(true),
+	//    }))
+	//
+	//    svc := s3.New(sess)
+	//    out, err := svc.GetObject(&s3.GetObjectInput {
+	//    	Bucket: aws.String("bucketname"),
+	//    	Key: aws.String("/foo/bar/moo"),
+	//    })
+	EnableEndpointDiscovery *bool
+
+	// DisableEndpointHostPrefix will disable the SDK's behavior of prefixing
+	// request endpoint hosts with modeled information.
+	//
+	// Disabling this feature is useful when you want to use local endpoints
+	// for testing that do not support the modeled host prefix pattern.
+	DisableEndpointHostPrefix *bool
+}
+
+// NewConfig returns a new Config pointer that can be chained with builder
+// methods to set multiple configuration values inline without using pointers.
+//
+//     // Create Session with MaxRetry configuration to be shared by multiple
+//     // service clients.
+//     sess := session.Must(session.NewSession(aws.NewConfig().
+//         WithMaxRetries(3),
+//     ))
+//
+//     // Create S3 service client with a specific Region.
+//     svc := s3.New(sess, aws.NewConfig().
+//         WithRegion("us-west-2"),
+//     )
+func NewConfig() *Config {
+	return &Config{}
+}
+
+// WithCredentialsChainVerboseErrors sets a config verbose errors boolean and returning
+// a Config pointer.
+func (c *Config) WithCredentialsChainVerboseErrors(verboseErrs bool) *Config {
+	c.CredentialsChainVerboseErrors = &verboseErrs
+	return c
+}
+
+// WithCredentials sets a config Credentials value returning a Config pointer
+// for chaining.
+func (c *Config) WithCredentials(creds *credentials.Credentials) *Config {
+	c.Credentials = creds
+	return c
+}
+
+// WithEndpoint sets a config Endpoint value returning a Config pointer for
+// chaining.
+func (c *Config) WithEndpoint(endpoint string) *Config {
+	c.Endpoint = &endpoint
+	return c
+}
+
+// WithEndpointResolver sets a config EndpointResolver value returning a
+// Config pointer for chaining.
+func (c *Config) WithEndpointResolver(resolver endpoints.Resolver) *Config {
+	c.EndpointResolver = resolver
+	return c
+}
+
+// WithRegion sets a config Region value returning a Config pointer for
+// chaining.
+func (c *Config) WithRegion(region string) *Config {
+	c.Region = &region
+	return c
+}
+
+// WithDisableSSL sets a config DisableSSL value returning a Config pointer
+// for chaining.
+func (c *Config) WithDisableSSL(disable bool) *Config {
+	c.DisableSSL = &disable
+	return c
+}
+
+// WithHTTPClient sets a config HTTPClient value returning a Config pointer
+// for chaining.
+func (c *Config) WithHTTPClient(client *http.Client) *Config {
+	c.HTTPClient = client
+	return c
+}
+
+// WithMaxRetries sets a config MaxRetries value returning a Config pointer
+// for chaining.
+func (c *Config) WithMaxRetries(max int) *Config {
+	c.MaxRetries = &max
+	return c
+}
+
+// WithDisableParamValidation sets a config DisableParamValidation value
+// returning a Config pointer for chaining.
+func (c *Config) WithDisableParamValidation(disable bool) *Config {
+	c.DisableParamValidation = &disable
+	return c
+}
+
+// WithDisableComputeChecksums sets a config DisableComputeChecksums value
+// returning a Config pointer for chaining.
+func (c *Config) WithDisableComputeChecksums(disable bool) *Config {
+	c.DisableComputeChecksums = &disable
+	return c
+}
+
+// WithLogLevel sets a config LogLevel value returning a Config pointer for
+// chaining.
+func (c *Config) WithLogLevel(level LogLevelType) *Config {
+	c.LogLevel = &level
+	return c
+}
+
+// WithLogger sets a config Logger value returning a Config pointer for
+// chaining.
+func (c *Config) WithLogger(logger Logger) *Config {
+	c.Logger = logger
+	return c
+}
+
+// WithS3ForcePathStyle sets a config S3ForcePathStyle value returning a Config
+// pointer for chaining.
+func (c *Config) WithS3ForcePathStyle(force bool) *Config {
+	c.S3ForcePathStyle = &force
+	return c
+}
+
+// WithS3Disable100Continue sets a config S3Disable100Continue value returning
+// a Config pointer for chaining.
+func (c *Config) WithS3Disable100Continue(disable bool) *Config {
+	c.S3Disable100Continue = &disable
+	return c
+}
+
+// WithS3UseAccelerate sets a config S3UseAccelerate value returning a Config
+// pointer for chaining.
+func (c *Config) WithS3UseAccelerate(enable bool) *Config {
+	c.S3UseAccelerate = &enable
+	return c
+
+}
+
+// WithS3DisableContentMD5Validation sets a config
+// S3DisableContentMD5Validation value returning a Config pointer for chaining.
+func (c *Config) WithS3DisableContentMD5Validation(enable bool) *Config {
+	c.S3DisableContentMD5Validation = &enable
+	return c
+
+}
+
+// WithUseDualStack sets a config UseDualStack value returning a Config
+// pointer for chaining.
+func (c *Config) WithUseDualStack(enable bool) *Config {
+	c.UseDualStack = &enable
+	return c
+}
+
+// WithEC2MetadataDisableTimeoutOverride sets a config EC2MetadataDisableTimeoutOverride value
+// returning a Config pointer for chaining.
+func (c *Config) WithEC2MetadataDisableTimeoutOverride(enable bool) *Config {
+	c.EC2MetadataDisableTimeoutOverride = &enable
+	return c
+}
+
+// WithSleepDelay overrides the function used to sleep while waiting for the
+// next retry. Defaults to time.Sleep.
+func (c *Config) WithSleepDelay(fn func(time.Duration)) *Config {
+	c.SleepDelay = fn
+	return c
+}
+
+// WithEndpointDiscovery will set whether or not to use endpoint discovery.
+func (c *Config) WithEndpointDiscovery(t bool) *Config {
+	c.EnableEndpointDiscovery = &t
+	return c
+}
+
+// WithDisableEndpointHostPrefix will set whether or not to use modeled host prefix
+// when making requests.
+func (c *Config) WithDisableEndpointHostPrefix(t bool) *Config {
+	c.DisableEndpointHostPrefix = &t
+	return c
+}
+
+// MergeIn merges the passed in configs into the existing config object.
+func (c *Config) MergeIn(cfgs ...*Config) {
+	for _, other := range cfgs {
+		mergeInConfig(c, other)
+	}
+}
+
+func mergeInConfig(dst *Config, other *Config) {
+	if other == nil {
+		return
+	}
+
+	if other.CredentialsChainVerboseErrors != nil {
+		dst.CredentialsChainVerboseErrors = other.CredentialsChainVerboseErrors
+	}
+
+	if other.Credentials != nil {
+		dst.Credentials = other.Credentials
+	}
+
+	if other.Endpoint != nil {
+		dst.Endpoint = other.Endpoint
+	}
+
+	if other.EndpointResolver != nil {
+		dst.EndpointResolver = other.EndpointResolver
+	}
+
+	if other.Region != nil {
+		dst.Region = other.Region
+	}
+
+	if other.DisableSSL != nil {
+		dst.DisableSSL = other.DisableSSL
+	}
+
+	if other.HTTPClient != nil {
+		dst.HTTPClient = other.HTTPClient
+	}
+
+	if other.LogLevel != nil {
+		dst.LogLevel = other.LogLevel
+	}
+
+	if other.Logger != nil {
+		dst.Logger = other.Logger
+	}
+
+	if other.MaxRetries != nil {
+		dst.MaxRetries = other.MaxRetries
+	}
+
+	if other.Retryer != nil {
+		dst.Retryer = other.Retryer
+	}
+
+	if other.DisableParamValidation != nil {
+		dst.DisableParamValidation = other.DisableParamValidation
+	}
+
+	if other.DisableComputeChecksums != nil {
+		dst.DisableComputeChecksums = other.DisableComputeChecksums
+	}
+
+	if other.S3ForcePathStyle != nil {
+		dst.S3ForcePathStyle = other.S3ForcePathStyle
+	}
+
+	if other.S3Disable100Continue != nil {
+		dst.S3Disable100Continue = other.S3Disable100Continue
+	}
+
+	if other.S3UseAccelerate != nil {
+		dst.S3UseAccelerate = other.S3UseAccelerate
+	}
+
+	if other.S3DisableContentMD5Validation != nil {
+		dst.S3DisableContentMD5Validation = other.S3DisableContentMD5Validation
+	}
+
+	if other.UseDualStack != nil {
+		dst.UseDualStack = other.UseDualStack
+	}
+
+	if other.EC2MetadataDisableTimeoutOverride != nil {
+		dst.EC2MetadataDisableTimeoutOverride = other.EC2MetadataDisableTimeoutOverride
+	}
+
+	if other.SleepDelay != nil {
+		dst.SleepDelay = other.SleepDelay
+	}
+
+	if other.DisableRestProtocolURICleaning != nil {
+		dst.DisableRestProtocolURICleaning = other.DisableRestProtocolURICleaning
+	}
+
+	if other.EnforceShouldRetryCheck != nil {
+		dst.EnforceShouldRetryCheck = other.EnforceShouldRetryCheck
+	}
+
+	if other.EnableEndpointDiscovery != nil {
+		dst.EnableEndpointDiscovery = other.EnableEndpointDiscovery
+	}
+
+	if other.DisableEndpointHostPrefix != nil {
+		dst.DisableEndpointHostPrefix = other.DisableEndpointHostPrefix
+	}
+}
+
+// Copy will return a shallow copy of the Config object. If any additional
+// configurations are provided they will be merged into the new config returned.
+func (c *Config) Copy(cfgs ...*Config) *Config {
+	dst := &Config{}
+	dst.MergeIn(c)
+
+	for _, cfg := range cfgs {
+		dst.MergeIn(cfg)
+	}
+
+	return dst
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/context_1_5.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/context_1_5.go
new file mode 100644
index 00000000..2866f9a7
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/context_1_5.go
@@ -0,0 +1,37 @@
+// +build !go1.9
+
+package aws
+
+import "time"
+
+// Context is an copy of the Go v1.7 stdlib's context.Context interface.
+// It is represented as a SDK interface to enable you to use the "WithContext"
+// API methods with Go v1.6 and a Context type such as golang.org/x/net/context.
+//
+// See https://golang.org/pkg/context on how to use contexts.
+type Context interface {
+	// Deadline returns the time when work done on behalf of this context
+	// should be canceled. Deadline returns ok==false when no deadline is
+	// set. Successive calls to Deadline return the same results.
+	Deadline() (deadline time.Time, ok bool)
+
+	// Done returns a channel that's closed when work done on behalf of this
+	// context should be canceled. Done may return nil if this context can
+	// never be canceled. Successive calls to Done return the same value.
+	Done() <-chan struct{}
+
+	// Err returns a non-nil error value after Done is closed. Err returns
+	// Canceled if the context was canceled or DeadlineExceeded if the
+	// context's deadline passed. No other values for Err are defined.
+	// After Done is closed, successive calls to Err return the same value.
+	Err() error
+
+	// Value returns the value associated with this context for key, or nil
+	// if no value is associated with key. Successive calls to Value with
+	// the same key returns the same result.
+	//
+	// Use context values only for request-scoped data that transits
+	// processes and API boundaries, not for passing optional parameters to
+	// functions.
+	Value(key interface{}) interface{}
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/context_1_9.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/context_1_9.go
new file mode 100644
index 00000000..3718b26e
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/context_1_9.go
@@ -0,0 +1,11 @@
+// +build go1.9
+
+package aws
+
+import "context"
+
+// Context is an alias of the Go stdlib's context.Context interface.
+// It can be used within the SDK's API operation "WithContext" methods.
+//
+// See https://golang.org/pkg/context on how to use contexts.
+type Context = context.Context
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/context_background_1_5.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/context_background_1_5.go
new file mode 100644
index 00000000..66c5945d
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/context_background_1_5.go
@@ -0,0 +1,56 @@
+// +build !go1.7
+
+package aws
+
+import "time"
+
+// An emptyCtx is a copy of the Go 1.7 context.emptyCtx type. This is copied to
+// provide a 1.6 and 1.5 safe version of context that is compatible with Go
+// 1.7's Context.
+//
+// An emptyCtx is never canceled, has no values, and has no deadline. It is not
+// struct{}, since vars of this type must have distinct addresses.
+type emptyCtx int
+
+func (*emptyCtx) Deadline() (deadline time.Time, ok bool) {
+	return
+}
+
+func (*emptyCtx) Done() <-chan struct{} {
+	return nil
+}
+
+func (*emptyCtx) Err() error {
+	return nil
+}
+
+func (*emptyCtx) Value(key interface{}) interface{} {
+	return nil
+}
+
+func (e *emptyCtx) String() string {
+	switch e {
+	case backgroundCtx:
+		return "aws.BackgroundContext"
+	}
+	return "unknown empty Context"
+}
+
+var (
+	backgroundCtx = new(emptyCtx)
+)
+
+// BackgroundContext returns a context that will never be canceled, has no
+// values, and no deadline. This context is used by the SDK to provide
+// backwards compatibility with non-context API operations and functionality.
+//
+// Go 1.6 and before:
+// This context function is equivalent to context.Background in the Go stdlib.
+//
+// Go 1.7 and later:
+// The context returned will be the value returned by context.Background()
+//
+// See https://golang.org/pkg/context for more information on Contexts.
+func BackgroundContext() Context {
+	return backgroundCtx
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/context_background_1_7.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/context_background_1_7.go
new file mode 100644
index 00000000..9c29f29a
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/context_background_1_7.go
@@ -0,0 +1,20 @@
+// +build go1.7
+
+package aws
+
+import "context"
+
+// BackgroundContext returns a context that will never be canceled, has no
+// values, and no deadline. This context is used by the SDK to provide
+// backwards compatibility with non-context API operations and functionality.
+//
+// Go 1.6 and before:
+// This context function is equivalent to context.Background in the Go stdlib.
+//
+// Go 1.7 and later:
+// The context returned will be the value returned by context.Background()
+//
+// See https://golang.org/pkg/context for more information on Contexts.
+func BackgroundContext() Context {
+	return context.Background()
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/context_sleep.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/context_sleep.go
new file mode 100644
index 00000000..304fd156
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/context_sleep.go
@@ -0,0 +1,24 @@
+package aws
+
+import (
+	"time"
+)
+
+// SleepWithContext will wait for the timer duration to expire, or the context
+// is canceled. Which ever happens first. If the context is canceled the Context's
+// error will be returned.
+//
+// Expects Context to always return a non-nil error if the Done channel is closed.
+func SleepWithContext(ctx Context, dur time.Duration) error {
+	t := time.NewTimer(dur)
+	defer t.Stop()
+
+	select {
+	case <-t.C:
+		break
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+
+	return nil
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/convert_types.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/convert_types.go
new file mode 100644
index 00000000..ff5d58e0
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/convert_types.go
@@ -0,0 +1,387 @@
+package aws
+
+import "time"
+
+// String returns a pointer to the string value passed in.
+func String(v string) *string {
+	return &v
+}
+
+// StringValue returns the value of the string pointer passed in or
+// "" if the pointer is nil.
+func StringValue(v *string) string {
+	if v != nil {
+		return *v
+	}
+	return ""
+}
+
+// StringSlice converts a slice of string values into a slice of
+// string pointers
+func StringSlice(src []string) []*string {
+	dst := make([]*string, len(src))
+	for i := 0; i < len(src); i++ {
+		dst[i] = &(src[i])
+	}
+	return dst
+}
+
+// StringValueSlice converts a slice of string pointers into a slice of
+// string values
+func StringValueSlice(src []*string) []string {
+	dst := make([]string, len(src))
+	for i := 0; i < len(src); i++ {
+		if src[i] != nil {
+			dst[i] = *(src[i])
+		}
+	}
+	return dst
+}
+
+// StringMap converts a string map of string values into a string
+// map of string pointers
+func StringMap(src map[string]string) map[string]*string {
+	dst := make(map[string]*string)
+	for k, val := range src {
+		v := val
+		dst[k] = &v
+	}
+	return dst
+}
+
+// StringValueMap converts a string map of string pointers into a string
+// map of string values
+func StringValueMap(src map[string]*string) map[string]string {
+	dst := make(map[string]string)
+	for k, val := range src {
+		if val != nil {
+			dst[k] = *val
+		}
+	}
+	return dst
+}
+
+// Bool returns a pointer to the bool value passed in.
+func Bool(v bool) *bool {
+	return &v
+}
+
+// BoolValue returns the value of the bool pointer passed in or
+// false if the pointer is nil.
+func BoolValue(v *bool) bool {
+	if v != nil {
+		return *v
+	}
+	return false
+}
+
+// BoolSlice converts a slice of bool values into a slice of
+// bool pointers
+func BoolSlice(src []bool) []*bool {
+	dst := make([]*bool, len(src))
+	for i := 0; i < len(src); i++ {
+		dst[i] = &(src[i])
+	}
+	return dst
+}
+
+// BoolValueSlice converts a slice of bool pointers into a slice of
+// bool values
+func BoolValueSlice(src []*bool) []bool {
+	dst := make([]bool, len(src))
+	for i := 0; i < len(src); i++ {
+		if src[i] != nil {
+			dst[i] = *(src[i])
+		}
+	}
+	return dst
+}
+
+// BoolMap converts a string map of bool values into a string
+// map of bool pointers
+func BoolMap(src map[string]bool) map[string]*bool {
+	dst := make(map[string]*bool)
+	for k, val := range src {
+		v := val
+		dst[k] = &v
+	}
+	return dst
+}
+
+// BoolValueMap converts a string map of bool pointers into a string
+// map of bool values
+func BoolValueMap(src map[string]*bool) map[string]bool {
+	dst := make(map[string]bool)
+	for k, val := range src {
+		if val != nil {
+			dst[k] = *val
+		}
+	}
+	return dst
+}
+
+// Int returns a pointer to the int value passed in.
+func Int(v int) *int {
+	return &v
+}
+
+// IntValue returns the value of the int pointer passed in or
+// 0 if the pointer is nil.
+func IntValue(v *int) int {
+	if v != nil {
+		return *v
+	}
+	return 0
+}
+
+// IntSlice converts a slice of int values into a slice of
+// int pointers
+func IntSlice(src []int) []*int {
+	dst := make([]*int, len(src))
+	for i := 0; i < len(src); i++ {
+		dst[i] = &(src[i])
+	}
+	return dst
+}
+
+// IntValueSlice converts a slice of int pointers into a slice of
+// int values
+func IntValueSlice(src []*int) []int {
+	dst := make([]int, len(src))
+	for i := 0; i < len(src); i++ {
+		if src[i] != nil {
+			dst[i] = *(src[i])
+		}
+	}
+	return dst
+}
+
+// IntMap converts a string map of int values into a string
+// map of int pointers
+func IntMap(src map[string]int) map[string]*int {
+	dst := make(map[string]*int)
+	for k, val := range src {
+		v := val
+		dst[k] = &v
+	}
+	return dst
+}
+
+// IntValueMap converts a string map of int pointers into a string
+// map of int values
+func IntValueMap(src map[string]*int) map[string]int {
+	dst := make(map[string]int)
+	for k, val := range src {
+		if val != nil {
+			dst[k] = *val
+		}
+	}
+	return dst
+}
+
+// Int64 returns a pointer to the int64 value passed in.
+func Int64(v int64) *int64 {
+	return &v
+}
+
+// Int64Value returns the value of the int64 pointer passed in or
+// 0 if the pointer is nil.
+func Int64Value(v *int64) int64 {
+	if v != nil {
+		return *v
+	}
+	return 0
+}
+
+// Int64Slice converts a slice of int64 values into a slice of
+// int64 pointers
+func Int64Slice(src []int64) []*int64 {
+	dst := make([]*int64, len(src))
+	for i := 0; i < len(src); i++ {
+		dst[i] = &(src[i])
+	}
+	return dst
+}
+
+// Int64ValueSlice converts a slice of int64 pointers into a slice of
+// int64 values
+func Int64ValueSlice(src []*int64) []int64 {
+	dst := make([]int64, len(src))
+	for i := 0; i < len(src); i++ {
+		if src[i] != nil {
+			dst[i] = *(src[i])
+		}
+	}
+	return dst
+}
+
+// Int64Map converts a string map of int64 values into a string
+// map of int64 pointers
+func Int64Map(src map[string]int64) map[string]*int64 {
+	dst := make(map[string]*int64)
+	for k, val := range src {
+		v := val
+		dst[k] = &v
+	}
+	return dst
+}
+
+// Int64ValueMap converts a string map of int64 pointers into a string
+// map of int64 values
+func Int64ValueMap(src map[string]*int64) map[string]int64 {
+	dst := make(map[string]int64)
+	for k, val := range src {
+		if val != nil {
+			dst[k] = *val
+		}
+	}
+	return dst
+}
+
+// Float64 returns a pointer to the float64 value passed in.
+func Float64(v float64) *float64 {
+	return &v
+}
+
+// Float64Value returns the value of the float64 pointer passed in or
+// 0 if the pointer is nil.
+func Float64Value(v *float64) float64 {
+	if v != nil {
+		return *v
+	}
+	return 0
+}
+
+// Float64Slice converts a slice of float64 values into a slice of
+// float64 pointers
+func Float64Slice(src []float64) []*float64 {
+	dst := make([]*float64, len(src))
+	for i := 0; i < len(src); i++ {
+		dst[i] = &(src[i])
+	}
+	return dst
+}
+
+// Float64ValueSlice converts a slice of float64 pointers into a slice of
+// float64 values
+func Float64ValueSlice(src []*float64) []float64 {
+	dst := make([]float64, len(src))
+	for i := 0; i < len(src); i++ {
+		if src[i] != nil {
+			dst[i] = *(src[i])
+		}
+	}
+	return dst
+}
+
+// Float64Map converts a string map of float64 values into a string
+// map of float64 pointers
+func Float64Map(src map[string]float64) map[string]*float64 {
+	dst := make(map[string]*float64)
+	for k, val := range src {
+		v := val
+		dst[k] = &v
+	}
+	return dst
+}
+
+// Float64ValueMap converts a string map of float64 pointers into a string
+// map of float64 values
+func Float64ValueMap(src map[string]*float64) map[string]float64 {
+	dst := make(map[string]float64)
+	for k, val := range src {
+		if val != nil {
+			dst[k] = *val
+		}
+	}
+	return dst
+}
+
+// Time returns a pointer to the time.Time value passed in.
+func Time(v time.Time) *time.Time {
+	return &v
+}
+
+// TimeValue returns the value of the time.Time pointer passed in or
+// time.Time{} if the pointer is nil.
+func TimeValue(v *time.Time) time.Time {
+	if v != nil {
+		return *v
+	}
+	return time.Time{}
+}
+
+// SecondsTimeValue converts an int64 pointer to a time.Time value
+// representing seconds since Epoch or time.Time{} if the pointer is nil.
+func SecondsTimeValue(v *int64) time.Time {
+	if v != nil {
+		return time.Unix((*v / 1000), 0)
+	}
+	return time.Time{}
+}
+
+// MillisecondsTimeValue converts an int64 pointer to a time.Time value
+// representing milliseconds sinch Epoch or time.Time{} if the pointer is nil.
+func MillisecondsTimeValue(v *int64) time.Time {
+	if v != nil {
+		return time.Unix(0, (*v * 1000000))
+	}
+	return time.Time{}
+}
+
+// TimeUnixMilli returns a Unix timestamp in milliseconds from "January 1, 1970 UTC".
+// The result is undefined if the Unix time cannot be represented by an int64.
+// Which includes calling TimeUnixMilli on a zero Time is undefined.
+//
+// This utility is useful for service API's such as CloudWatch Logs which require
+// their unix time values to be in milliseconds.
+//
+// See Go stdlib https://golang.org/pkg/time/#Time.UnixNano for more information.
+func TimeUnixMilli(t time.Time) int64 {
+	return t.UnixNano() / int64(time.Millisecond/time.Nanosecond)
+}
+
+// TimeSlice converts a slice of time.Time values into a slice of
+// time.Time pointers
+func TimeSlice(src []time.Time) []*time.Time {
+	dst := make([]*time.Time, len(src))
+	for i := 0; i < len(src); i++ {
+		dst[i] = &(src[i])
+	}
+	return dst
+}
+
+// TimeValueSlice converts a slice of time.Time pointers into a slice of
+// time.Time values
+func TimeValueSlice(src []*time.Time) []time.Time {
+	dst := make([]time.Time, len(src))
+	for i := 0; i < len(src); i++ {
+		if src[i] != nil {
+			dst[i] = *(src[i])
+		}
+	}
+	return dst
+}
+
+// TimeMap converts a string map of time.Time values into a string
+// map of time.Time pointers
+func TimeMap(src map[string]time.Time) map[string]*time.Time {
+	dst := make(map[string]*time.Time)
+	for k, val := range src {
+		v := val
+		dst[k] = &v
+	}
+	return dst
+}
+
+// TimeValueMap converts a string map of time.Time pointers into a string
+// map of time.Time values
+func TimeValueMap(src map[string]*time.Time) map[string]time.Time {
+	dst := make(map[string]time.Time)
+	for k, val := range src {
+		if val != nil {
+			dst[k] = *val
+		}
+	}
+	return dst
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/handlers.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/handlers.go
new file mode 100644
index 00000000..f8853d78
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/handlers.go
@@ -0,0 +1,228 @@
+package corehandlers
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"net/url"
+	"regexp"
+	"strconv"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/credentials"
+	"github.com/aws/aws-sdk-go/aws/request"
+)
+
+// Interface for matching types which also have a Len method.
+type lener interface {
+	Len() int
+}
+
+// BuildContentLengthHandler builds the content length of a request based on the body,
+// or will use the HTTPRequest.Header's "Content-Length" if defined. If unable
+// to determine request body length and no "Content-Length" was specified it will panic.
+//
+// The Content-Length will only be added to the request if the length of the body
+// is greater than 0. If the body is empty or the current `Content-Length`
+// header is <= 0, the header will also be stripped.
+var BuildContentLengthHandler = request.NamedHandler{Name: "core.BuildContentLengthHandler", Fn: func(r *request.Request) {
+	var length int64
+
+	if slength := r.HTTPRequest.Header.Get("Content-Length"); slength != "" {
+		length, _ = strconv.ParseInt(slength, 10, 64)
+	} else {
+		if r.Body != nil {
+			var err error
+			length, err = aws.SeekerLen(r.Body)
+			if err != nil {
+				r.Error = awserr.New(request.ErrCodeSerialization, "failed to get request body's length", err)
+				return
+			}
+		}
+	}
+
+	if length > 0 {
+		r.HTTPRequest.ContentLength = length
+		r.HTTPRequest.Header.Set("Content-Length", fmt.Sprintf("%d", length))
+	} else {
+		r.HTTPRequest.ContentLength = 0
+		r.HTTPRequest.Header.Del("Content-Length")
+	}
+}}
+
+var reStatusCode = regexp.MustCompile(`^(\d{3})`)
+
+// ValidateReqSigHandler is a request handler to ensure that the request's
+// signature doesn't expire before it is sent. This can happen when a request
+// is built and signed significantly before it is sent. Or significant delays
+// occur when retrying requests that would cause the signature to expire.
+var ValidateReqSigHandler = request.NamedHandler{
+	Name: "core.ValidateReqSigHandler",
+	Fn: func(r *request.Request) {
+		// Unsigned requests are not signed
+		if r.Config.Credentials == credentials.AnonymousCredentials {
+			return
+		}
+
+		signedTime := r.Time
+		if !r.LastSignedAt.IsZero() {
+			signedTime = r.LastSignedAt
+		}
+
+		// 5 minutes to allow for some clock skew/delays in transmission.
+		// Would be improved with aws/aws-sdk-go#423
+		if signedTime.Add(5 * time.Minute).After(time.Now()) {
+			return
+		}
+
+		fmt.Println("request expired, resigning")
+		r.Sign()
+	},
+}
+
+// SendHandler is a request handler to send service request using HTTP client.
+var SendHandler = request.NamedHandler{
+	Name: "core.SendHandler",
+	Fn: func(r *request.Request) {
+		sender := sendFollowRedirects
+		if r.DisableFollowRedirects {
+			sender = sendWithoutFollowRedirects
+		}
+
+		if request.NoBody == r.HTTPRequest.Body {
+			// Strip off the request body if the NoBody reader was used as a
+			// place holder for a request body. This prevents the SDK from
+			// making requests with a request body when it would be invalid
+			// to do so.
+			//
+			// Use a shallow copy of the http.Request to ensure the race condition
+			// of transport on Body will not trigger
+			reqOrig, reqCopy := r.HTTPRequest, *r.HTTPRequest
+			reqCopy.Body = nil
+			r.HTTPRequest = &reqCopy
+			defer func() {
+				r.HTTPRequest = reqOrig
+			}()
+		}
+
+		var err error
+		r.HTTPResponse, err = sender(r)
+		if err != nil {
+			handleSendError(r, err)
+		}
+	},
+}
+
+func sendFollowRedirects(r *request.Request) (*http.Response, error) {
+	return r.Config.HTTPClient.Do(r.HTTPRequest)
+}
+
+func sendWithoutFollowRedirects(r *request.Request) (*http.Response, error) {
+	transport := r.Config.HTTPClient.Transport
+	if transport == nil {
+		transport = http.DefaultTransport
+	}
+
+	return transport.RoundTrip(r.HTTPRequest)
+}
+
+func handleSendError(r *request.Request, err error) {
+	// Prevent leaking if an HTTPResponse was returned. Clean up
+	// the body.
+	if r.HTTPResponse != nil {
+		r.HTTPResponse.Body.Close()
+	}
+	// Capture the case where url.Error is returned for error processing
+	// response. e.g. 301 without location header comes back as string
+	// error and r.HTTPResponse is nil. Other URL redirect errors will
+	// comeback in a similar method.
+	if e, ok := err.(*url.Error); ok && e.Err != nil {
+		if s := reStatusCode.FindStringSubmatch(e.Err.Error()); s != nil {
+			code, _ := strconv.ParseInt(s[1], 10, 64)
+			r.HTTPResponse = &http.Response{
+				StatusCode: int(code),
+				Status:     http.StatusText(int(code)),
+				Body:       ioutil.NopCloser(bytes.NewReader([]byte{})),
+			}
+			return
+		}
+	}
+	if r.HTTPResponse == nil {
+		// Add a dummy request response object to ensure the HTTPResponse
+		// value is consistent.
+		r.HTTPResponse = &http.Response{
+			StatusCode: int(0),
+			Status:     http.StatusText(int(0)),
+			Body:       ioutil.NopCloser(bytes.NewReader([]byte{})),
+		}
+	}
+	// Catch all other request errors.
+	r.Error = awserr.New("RequestError", "send request failed", err)
+	r.Retryable = aws.Bool(true) // network errors are retryable
+
+	// Override the error with a context canceled error, if that was canceled.
+	ctx := r.Context()
+	select {
+	case <-ctx.Done():
+		r.Error = awserr.New(request.CanceledErrorCode,
+			"request context canceled", ctx.Err())
+		r.Retryable = aws.Bool(false)
+	default:
+	}
+}
+
+// ValidateResponseHandler is a request handler to validate service response.
+var ValidateResponseHandler = request.NamedHandler{Name: "core.ValidateResponseHandler", Fn: func(r *request.Request) {
+	if r.HTTPResponse.StatusCode == 0 || r.HTTPResponse.StatusCode >= 300 {
+		// this may be replaced by an UnmarshalError handler
+		r.Error = awserr.New("UnknownError", "unknown error", nil)
+	}
+}}
+
+// AfterRetryHandler performs final checks to determine if the request should
+// be retried and how long to delay.
+var AfterRetryHandler = request.NamedHandler{Name: "core.AfterRetryHandler", Fn: func(r *request.Request) {
+	// If one of the other handlers already set the retry state
+	// we don't want to override it based on the service's state
+	if r.Retryable == nil || aws.BoolValue(r.Config.EnforceShouldRetryCheck) {
+		r.Retryable = aws.Bool(r.ShouldRetry(r))
+	}
+
+	if r.WillRetry() {
+		r.RetryDelay = r.RetryRules(r)
+
+		if sleepFn := r.Config.SleepDelay; sleepFn != nil {
+			// Support SleepDelay for backwards compatibility and testing
+			sleepFn(r.RetryDelay)
+		} else if err := aws.SleepWithContext(r.Context(), r.RetryDelay); err != nil {
+			r.Error = awserr.New(request.CanceledErrorCode,
+				"request context canceled", err)
+			r.Retryable = aws.Bool(false)
+			return
+		}
+
+		// when the expired token exception occurs the credentials
+		// need to be expired locally so that the next request to
+		// get credentials will trigger a credentials refresh.
+		if r.IsErrorExpired() {
+			r.Config.Credentials.Expire()
+		}
+
+		r.RetryCount++
+		r.Error = nil
+	}
+}}
+
+// ValidateEndpointHandler is a request handler to validate a request had the
+// appropriate Region and Endpoint set. Will set r.Error if the endpoint or
+// region is not valid.
+var ValidateEndpointHandler = request.NamedHandler{Name: "core.ValidateEndpointHandler", Fn: func(r *request.Request) {
+	if r.ClientInfo.SigningRegion == "" && aws.StringValue(r.Config.Region) == "" {
+		r.Error = aws.ErrMissingRegion
+	} else if r.ClientInfo.Endpoint == "" {
+		r.Error = aws.ErrMissingEndpoint
+	}
+}}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/param_validator.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/param_validator.go
new file mode 100644
index 00000000..7d50b155
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/param_validator.go
@@ -0,0 +1,17 @@
+package corehandlers
+
+import "github.com/aws/aws-sdk-go/aws/request"
+
+// ValidateParametersHandler is a request handler to validate the input parameters.
+// Validating parameters only has meaning if done prior to the request being sent.
+var ValidateParametersHandler = request.NamedHandler{Name: "core.ValidateParametersHandler", Fn: func(r *request.Request) {
+	if !r.ParamsFilled() {
+		return
+	}
+
+	if v, ok := r.Params.(request.Validator); ok {
+		if err := v.Validate(); err != nil {
+			r.Error = err
+		}
+	}
+}}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/user_agent.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/user_agent.go
new file mode 100644
index 00000000..ab69c7a6
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/user_agent.go
@@ -0,0 +1,37 @@
+package corehandlers
+
+import (
+	"os"
+	"runtime"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/request"
+)
+
+// SDKVersionUserAgentHandler is a request handler for adding the SDK Version
+// to the user agent.
+var SDKVersionUserAgentHandler = request.NamedHandler{
+	Name: "core.SDKVersionUserAgentHandler",
+	Fn: request.MakeAddToUserAgentHandler(aws.SDKName, aws.SDKVersion,
+		runtime.Version(), runtime.GOOS, runtime.GOARCH),
+}
+
+const execEnvVar = `AWS_EXECUTION_ENV`
+const execEnvUAKey = `exec-env`
+
+// AddHostExecEnvUserAgentHander is a request handler appending the SDK's
+// execution environment to the user agent.
+//
+// If the environment variable AWS_EXECUTION_ENV is set, its value will be
+// appended to the user agent string.
+var AddHostExecEnvUserAgentHander = request.NamedHandler{
+	Name: "core.AddHostExecEnvUserAgentHander",
+	Fn: func(r *request.Request) {
+		v := os.Getenv(execEnvVar)
+		if len(v) == 0 {
+			return
+		}
+
+		request.AddToUserAgent(r, execEnvUAKey+"/"+v)
+	},
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/credentials/chain_provider.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/credentials/chain_provider.go
new file mode 100644
index 00000000..3ad1e798
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/credentials/chain_provider.go
@@ -0,0 +1,100 @@
+package credentials
+
+import (
+	"github.com/aws/aws-sdk-go/aws/awserr"
+)
+
+var (
+	// ErrNoValidProvidersFoundInChain Is returned when there are no valid
+	// providers in the ChainProvider.
+	//
+	// This has been deprecated. For verbose error messaging set
+	// aws.Config.CredentialsChainVerboseErrors to true.
+	ErrNoValidProvidersFoundInChain = awserr.New("NoCredentialProviders",
+		`no valid providers in chain. Deprecated.
+	For verbose messaging see aws.Config.CredentialsChainVerboseErrors`,
+		nil)
+)
+
+// A ChainProvider will search for a provider which returns credentials
+// and cache that provider until Retrieve is called again.
+//
+// The ChainProvider provides a way of chaining multiple providers together
+// which will pick the first available using priority order of the Providers
+// in the list.
+//
+// If none of the Providers retrieve valid credentials Value, ChainProvider's
+// Retrieve() will return the error ErrNoValidProvidersFoundInChain.
+//
+// If a Provider is found which returns valid credentials Value ChainProvider
+// will cache that Provider for all calls to IsExpired(), until Retrieve is
+// called again.
+//
+// Example of ChainProvider to be used with an EnvProvider and EC2RoleProvider.
+// In this example EnvProvider will first check if any credentials are available
+// via the environment variables. If there are none ChainProvider will check
+// the next Provider in the list, EC2RoleProvider in this case. If EC2RoleProvider
+// does not return any credentials ChainProvider will return the error
+// ErrNoValidProvidersFoundInChain
+//
+//     creds := credentials.NewChainCredentials(
+//         []credentials.Provider{
+//             &credentials.EnvProvider{},
+//             &ec2rolecreds.EC2RoleProvider{
+//                 Client: ec2metadata.New(sess),
+//             },
+//         })
+//
+//     // Usage of ChainCredentials with aws.Config
+//     svc := ec2.New(session.Must(session.NewSession(&aws.Config{
+//       Credentials: creds,
+//     })))
+//
+type ChainProvider struct {
+	Providers     []Provider
+	curr          Provider
+	VerboseErrors bool
+}
+
+// NewChainCredentials returns a pointer to a new Credentials object
+// wrapping a chain of providers.
+func NewChainCredentials(providers []Provider) *Credentials {
+	return NewCredentials(&ChainProvider{
+		Providers: append([]Provider{}, providers...),
+	})
+}
+
+// Retrieve returns the credentials value or error if no provider returned
+// without error.
+//
+// If a provider is found it will be cached and any calls to IsExpired()
+// will return the expired state of the cached provider.
+func (c *ChainProvider) Retrieve() (Value, error) {
+	var errs []error
+	for _, p := range c.Providers {
+		creds, err := p.Retrieve()
+		if err == nil {
+			c.curr = p
+			return creds, nil
+		}
+		errs = append(errs, err)
+	}
+	c.curr = nil
+
+	var err error
+	err = ErrNoValidProvidersFoundInChain
+	if c.VerboseErrors {
+		err = awserr.NewBatchError("NoCredentialProviders", "no valid providers in chain", errs)
+	}
+	return Value{}, err
+}
+
+// IsExpired will returned the expired state of the currently cached provider
+// if there is one.  If there is no current provider, true will be returned.
+func (c *ChainProvider) IsExpired() bool {
+	if c.curr != nil {
+		return c.curr.IsExpired()
+	}
+
+	return true
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/credentials/credentials.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/credentials/credentials.go
new file mode 100644
index 00000000..894bbc7f
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/credentials/credentials.go
@@ -0,0 +1,292 @@
+// Package credentials provides credential retrieval and management
+//
+// The Credentials is the primary method of getting access to and managing
+// credentials Values. Using dependency injection retrieval of the credential
+// values is handled by a object which satisfies the Provider interface.
+//
+// By default the Credentials.Get() will cache the successful result of a
+// Provider's Retrieve() until Provider.IsExpired() returns true. At which
+// point Credentials will call Provider's Retrieve() to get new credential Value.
+//
+// The Provider is responsible for determining when credentials Value have expired.
+// It is also important to note that Credentials will always call Retrieve the
+// first time Credentials.Get() is called.
+//
+// Example of using the environment variable credentials.
+//
+//     creds := credentials.NewEnvCredentials()
+//
+//     // Retrieve the credentials value
+//     credValue, err := creds.Get()
+//     if err != nil {
+//         // handle error
+//     }
+//
+// Example of forcing credentials to expire and be refreshed on the next Get().
+// This may be helpful to proactively expire credentials and refresh them sooner
+// than they would naturally expire on their own.
+//
+//     creds := credentials.NewCredentials(&ec2rolecreds.EC2RoleProvider{})
+//     creds.Expire()
+//     credsValue, err := creds.Get()
+//     // New credentials will be retrieved instead of from cache.
+//
+//
+// Custom Provider
+//
+// Each Provider built into this package also provides a helper method to generate
+// a Credentials pointer setup with the provider. To use a custom Provider just
+// create a type which satisfies the Provider interface and pass it to the
+// NewCredentials method.
+//
+//     type MyProvider struct{}
+//     func (m *MyProvider) Retrieve() (Value, error) {...}
+//     func (m *MyProvider) IsExpired() bool {...}
+//
+//     creds := credentials.NewCredentials(&MyProvider{})
+//     credValue, err := creds.Get()
+//
+package credentials
+
+import (
+	"fmt"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"sync"
+	"time"
+)
+
+// AnonymousCredentials is an empty Credential object that can be used as
+// dummy placeholder credentials for requests that do not need signed.
+//
+// This Credentials can be used to configure a service to not sign requests
+// when making service API calls. For example, when accessing public
+// s3 buckets.
+//
+//     svc := s3.New(session.Must(session.NewSession(&aws.Config{
+//       Credentials: credentials.AnonymousCredentials,
+//     })))
+//     // Access public S3 buckets.
+var AnonymousCredentials = NewStaticCredentials("", "", "")
+
+// A Value is the AWS credentials value for individual credential fields.
+type Value struct {
+	// AWS Access key ID
+	AccessKeyID string
+
+	// AWS Secret Access Key
+	SecretAccessKey string
+
+	// AWS Session Token
+	SessionToken string
+
+	// Provider used to get credentials
+	ProviderName string
+}
+
+// A Provider is the interface for any component which will provide credentials
+// Value. A provider is required to manage its own Expired state, and what to
+// be expired means.
+//
+// The Provider should not need to implement its own mutexes, because
+// that will be managed by Credentials.
+type Provider interface {
+	// Retrieve returns nil if it successfully retrieved the value.
+	// Error is returned if the value were not obtainable, or empty.
+	Retrieve() (Value, error)
+
+	// IsExpired returns if the credentials are no longer valid, and need
+	// to be retrieved.
+	IsExpired() bool
+}
+
+// An Expirer is an interface that Providers can implement to expose the expiration
+// time, if known.  If the Provider cannot accurately provide this info,
+// it should not implement this interface.
+type Expirer interface {
+	// The time at which the credentials are no longer valid
+	ExpiresAt() time.Time
+}
+
+// An ErrorProvider is a stub credentials provider that always returns an error
+// this is used by the SDK when construction a known provider is not possible
+// due to an error.
+type ErrorProvider struct {
+	// The error to be returned from Retrieve
+	Err error
+
+	// The provider name to set on the Retrieved returned Value
+	ProviderName string
+}
+
+// Retrieve will always return the error that the ErrorProvider was created with.
+func (p ErrorProvider) Retrieve() (Value, error) {
+	return Value{ProviderName: p.ProviderName}, p.Err
+}
+
+// IsExpired will always return not expired.
+func (p ErrorProvider) IsExpired() bool {
+	return false
+}
+
+// A Expiry provides shared expiration logic to be used by credentials
+// providers to implement expiry functionality.
+//
+// The best method to use this struct is as an anonymous field within the
+// provider's struct.
+//
+// Example:
+//     type EC2RoleProvider struct {
+//         Expiry
+//         ...
+//     }
+type Expiry struct {
+	// The date/time when to expire on
+	expiration time.Time
+
+	// If set will be used by IsExpired to determine the current time.
+	// Defaults to time.Now if CurrentTime is not set.  Available for testing
+	// to be able to mock out the current time.
+	CurrentTime func() time.Time
+}
+
+// SetExpiration sets the expiration IsExpired will check when called.
+//
+// If window is greater than 0 the expiration time will be reduced by the
+// window value.
+//
+// Using a window is helpful to trigger credentials to expire sooner than
+// the expiration time given to ensure no requests are made with expired
+// tokens.
+func (e *Expiry) SetExpiration(expiration time.Time, window time.Duration) {
+	e.expiration = expiration
+	if window > 0 {
+		e.expiration = e.expiration.Add(-window)
+	}
+}
+
+// IsExpired returns if the credentials are expired.
+func (e *Expiry) IsExpired() bool {
+	curTime := e.CurrentTime
+	if curTime == nil {
+		curTime = time.Now
+	}
+	return e.expiration.Before(curTime())
+}
+
+// ExpiresAt returns the expiration time of the credential
+func (e *Expiry) ExpiresAt() time.Time {
+	return e.expiration
+}
+
+// A Credentials provides concurrency safe retrieval of AWS credentials Value.
+// Credentials will cache the credentials value until they expire. Once the value
+// expires the next Get will attempt to retrieve valid credentials.
+//
+// Credentials is safe to use across multiple goroutines and will manage the
+// synchronous state so the Providers do not need to implement their own
+// synchronization.
+//
+// The first Credentials.Get() will always call Provider.Retrieve() to get the
+// first instance of the credentials Value. All calls to Get() after that
+// will return the cached credentials Value until IsExpired() returns true.
+type Credentials struct {
+	creds        Value
+	forceRefresh bool
+
+	m sync.RWMutex
+
+	provider Provider
+}
+
+// NewCredentials returns a pointer to a new Credentials with the provider set.
+func NewCredentials(provider Provider) *Credentials {
+	return &Credentials{
+		provider:     provider,
+		forceRefresh: true,
+	}
+}
+
+// Get returns the credentials value, or error if the credentials Value failed
+// to be retrieved.
+//
+// Will return the cached credentials Value if it has not expired. If the
+// credentials Value has expired the Provider's Retrieve() will be called
+// to refresh the credentials.
+//
+// If Credentials.Expire() was called the credentials Value will be force
+// expired, and the next call to Get() will cause them to be refreshed.
+func (c *Credentials) Get() (Value, error) {
+	// Check the cached credentials first with just the read lock.
+	c.m.RLock()
+	if !c.isExpired() {
+		creds := c.creds
+		c.m.RUnlock()
+		return creds, nil
+	}
+	c.m.RUnlock()
+
+	// Credentials are expired need to retrieve the credentials taking the full
+	// lock.
+	c.m.Lock()
+	defer c.m.Unlock()
+
+	if c.isExpired() {
+		creds, err := c.provider.Retrieve()
+		if err != nil {
+			return Value{}, err
+		}
+		c.creds = creds
+		c.forceRefresh = false
+	}
+
+	return c.creds, nil
+}
+
+// Expire expires the credentials and forces them to be retrieved on the
+// next call to Get().
+//
+// This will override the Provider's expired state, and force Credentials
+// to call the Provider's Retrieve().
+func (c *Credentials) Expire() {
+	c.m.Lock()
+	defer c.m.Unlock()
+
+	c.forceRefresh = true
+}
+
+// IsExpired returns if the credentials are no longer valid, and need
+// to be retrieved.
+//
+// If the Credentials were forced to be expired with Expire() this will
+// reflect that override.
+func (c *Credentials) IsExpired() bool {
+	c.m.RLock()
+	defer c.m.RUnlock()
+
+	return c.isExpired()
+}
+
+// isExpired helper method wrapping the definition of expired credentials.
+func (c *Credentials) isExpired() bool {
+	return c.forceRefresh || c.provider.IsExpired()
+}
+
+// ExpiresAt provides access to the functionality of the Expirer interface of
+// the underlying Provider, if it supports that interface.  Otherwise, it returns
+// an error.
+func (c *Credentials) ExpiresAt() (time.Time, error) {
+	c.m.RLock()
+	defer c.m.RUnlock()
+
+	expirer, ok := c.provider.(Expirer)
+	if !ok {
+		return time.Time{}, awserr.New("ProviderNotExpirer",
+			fmt.Sprintf("provider %s does not support ExpiresAt()", c.creds.ProviderName),
+			nil)
+	}
+	if c.forceRefresh {
+		// set expiration time to the distant past
+		return time.Time{}, nil
+	}
+	return expirer.ExpiresAt(), nil
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/credentials/env_provider.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/credentials/env_provider.go
new file mode 100644
index 00000000..54c5cf73
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/credentials/env_provider.go
@@ -0,0 +1,74 @@
+package credentials
+
+import (
+	"os"
+
+	"github.com/aws/aws-sdk-go/aws/awserr"
+)
+
+// EnvProviderName provides a name of Env provider
+const EnvProviderName = "EnvProvider"
+
+var (
+	// ErrAccessKeyIDNotFound is returned when the AWS Access Key ID can't be
+	// found in the process's environment.
+	ErrAccessKeyIDNotFound = awserr.New("EnvAccessKeyNotFound", "AWS_ACCESS_KEY_ID or AWS_ACCESS_KEY not found in environment", nil)
+
+	// ErrSecretAccessKeyNotFound is returned when the AWS Secret Access Key
+	// can't be found in the process's environment.
+	ErrSecretAccessKeyNotFound = awserr.New("EnvSecretNotFound", "AWS_SECRET_ACCESS_KEY or AWS_SECRET_KEY not found in environment", nil)
+)
+
+// A EnvProvider retrieves credentials from the environment variables of the
+// running process. Environment credentials never expire.
+//
+// Environment variables used:
+//
+// * Access Key ID:     AWS_ACCESS_KEY_ID or AWS_ACCESS_KEY
+//
+// * Secret Access Key: AWS_SECRET_ACCESS_KEY or AWS_SECRET_KEY
+type EnvProvider struct {
+	retrieved bool
+}
+
+// NewEnvCredentials returns a pointer to a new Credentials object
+// wrapping the environment variable provider.
+func NewEnvCredentials() *Credentials {
+	return NewCredentials(&EnvProvider{})
+}
+
+// Retrieve retrieves the keys from the environment.
+func (e *EnvProvider) Retrieve() (Value, error) {
+	e.retrieved = false
+
+	id := os.Getenv("AWS_ACCESS_KEY_ID")
+	if id == "" {
+		id = os.Getenv("AWS_ACCESS_KEY")
+	}
+
+	secret := os.Getenv("AWS_SECRET_ACCESS_KEY")
+	if secret == "" {
+		secret = os.Getenv("AWS_SECRET_KEY")
+	}
+
+	if id == "" {
+		return Value{ProviderName: EnvProviderName}, ErrAccessKeyIDNotFound
+	}
+
+	if secret == "" {
+		return Value{ProviderName: EnvProviderName}, ErrSecretAccessKeyNotFound
+	}
+
+	e.retrieved = true
+	return Value{
+		AccessKeyID:     id,
+		SecretAccessKey: secret,
+		SessionToken:    os.Getenv("AWS_SESSION_TOKEN"),
+		ProviderName:    EnvProviderName,
+	}, nil
+}
+
+// IsExpired returns if the credentials have been retrieved.
+func (e *EnvProvider) IsExpired() bool {
+	return !e.retrieved
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/credentials/example.ini b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/credentials/example.ini
new file mode 100644
index 00000000..7fc91d9d
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/credentials/example.ini
@@ -0,0 +1,12 @@
+[default]
+aws_access_key_id = accessKey
+aws_secret_access_key = secret
+aws_session_token = token
+
+[no_token]
+aws_access_key_id = accessKey
+aws_secret_access_key = secret
+
+[with_colon]
+aws_access_key_id: accessKey
+aws_secret_access_key: secret
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/credentials/shared_credentials_provider.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/credentials/shared_credentials_provider.go
new file mode 100644
index 00000000..e1551495
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/credentials/shared_credentials_provider.go
@@ -0,0 +1,150 @@
+package credentials
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/internal/ini"
+	"github.com/aws/aws-sdk-go/internal/shareddefaults"
+)
+
+// SharedCredsProviderName provides a name of SharedCreds provider
+const SharedCredsProviderName = "SharedCredentialsProvider"
+
+var (
+	// ErrSharedCredentialsHomeNotFound is emitted when the user directory cannot be found.
+	ErrSharedCredentialsHomeNotFound = awserr.New("UserHomeNotFound", "user home directory not found.", nil)
+)
+
+// A SharedCredentialsProvider retrieves credentials from the current user's home
+// directory, and keeps track if those credentials are expired.
+//
+// Profile ini file example: $HOME/.aws/credentials
+type SharedCredentialsProvider struct {
+	// Path to the shared credentials file.
+	//
+	// If empty will look for "AWS_SHARED_CREDENTIALS_FILE" env variable. If the
+	// env value is empty will default to current user's home directory.
+	// Linux/OSX: "$HOME/.aws/credentials"
+	// Windows:   "%USERPROFILE%\.aws\credentials"
+	Filename string
+
+	// AWS Profile to extract credentials from the shared credentials file. If empty
+	// will default to environment variable "AWS_PROFILE" or "default" if
+	// environment variable is also not set.
+	Profile string
+
+	// retrieved states if the credentials have been successfully retrieved.
+	retrieved bool
+}
+
+// NewSharedCredentials returns a pointer to a new Credentials object
+// wrapping the Profile file provider.
+func NewSharedCredentials(filename, profile string) *Credentials {
+	return NewCredentials(&SharedCredentialsProvider{
+		Filename: filename,
+		Profile:  profile,
+	})
+}
+
+// Retrieve reads and extracts the shared credentials from the current
+// users home directory.
+func (p *SharedCredentialsProvider) Retrieve() (Value, error) {
+	p.retrieved = false
+
+	filename, err := p.filename()
+	if err != nil {
+		return Value{ProviderName: SharedCredsProviderName}, err
+	}
+
+	creds, err := loadProfile(filename, p.profile())
+	if err != nil {
+		return Value{ProviderName: SharedCredsProviderName}, err
+	}
+
+	p.retrieved = true
+	return creds, nil
+}
+
+// IsExpired returns if the shared credentials have expired.
+func (p *SharedCredentialsProvider) IsExpired() bool {
+	return !p.retrieved
+}
+
+// loadProfiles loads from the file pointed to by shared credentials filename for profile.
+// The credentials retrieved from the profile will be returned or error. Error will be
+// returned if it fails to read from the file, or the data is invalid.
+func loadProfile(filename, profile string) (Value, error) {
+	config, err := ini.OpenFile(filename)
+	if err != nil {
+		return Value{ProviderName: SharedCredsProviderName}, awserr.New("SharedCredsLoad", "failed to load shared credentials file", err)
+	}
+
+	iniProfile, ok := config.GetSection(profile)
+	if !ok {
+		return Value{ProviderName: SharedCredsProviderName}, awserr.New("SharedCredsLoad", "failed to get profile", nil)
+	}
+
+	id := iniProfile.String("aws_access_key_id")
+	if len(id) == 0 {
+		return Value{ProviderName: SharedCredsProviderName}, awserr.New("SharedCredsAccessKey",
+			fmt.Sprintf("shared credentials %s in %s did not contain aws_access_key_id", profile, filename),
+			nil)
+	}
+
+	secret := iniProfile.String("aws_secret_access_key")
+	if len(secret) == 0 {
+		return Value{ProviderName: SharedCredsProviderName}, awserr.New("SharedCredsSecret",
+			fmt.Sprintf("shared credentials %s in %s did not contain aws_secret_access_key", profile, filename),
+			nil)
+	}
+
+	// Default to empty string if not found
+	token := iniProfile.String("aws_session_token")
+
+	return Value{
+		AccessKeyID:     id,
+		SecretAccessKey: secret,
+		SessionToken:    token,
+		ProviderName:    SharedCredsProviderName,
+	}, nil
+}
+
+// filename returns the filename to use to read AWS shared credentials.
+//
+// Will return an error if the user's home directory path cannot be found.
+func (p *SharedCredentialsProvider) filename() (string, error) {
+	if len(p.Filename) != 0 {
+		return p.Filename, nil
+	}
+
+	if p.Filename = os.Getenv("AWS_SHARED_CREDENTIALS_FILE"); len(p.Filename) != 0 {
+		return p.Filename, nil
+	}
+
+	if home := shareddefaults.UserHomeDir(); len(home) == 0 {
+		// Backwards compatibility of home directly not found error being returned.
+		// This error is too verbose, failure when opening the file would of been
+		// a better error to return.
+		return "", ErrSharedCredentialsHomeNotFound
+	}
+
+	p.Filename = shareddefaults.SharedCredentialsFilename()
+
+	return p.Filename, nil
+}
+
+// profile returns the AWS shared credentials profile.  If empty will read
+// environment variable "AWS_PROFILE". If that is not set profile will
+// return "default".
+func (p *SharedCredentialsProvider) profile() string {
+	if p.Profile == "" {
+		p.Profile = os.Getenv("AWS_PROFILE")
+	}
+	if p.Profile == "" {
+		p.Profile = "default"
+	}
+
+	return p.Profile
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/credentials/static_provider.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/credentials/static_provider.go
new file mode 100644
index 00000000..531139e3
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/credentials/static_provider.go
@@ -0,0 +1,55 @@
+package credentials
+
+import (
+	"github.com/aws/aws-sdk-go/aws/awserr"
+)
+
+// StaticProviderName provides a name of Static provider
+const StaticProviderName = "StaticProvider"
+
+var (
+	// ErrStaticCredentialsEmpty is emitted when static credentials are empty.
+	ErrStaticCredentialsEmpty = awserr.New("EmptyStaticCreds", "static credentials are empty", nil)
+)
+
+// A StaticProvider is a set of credentials which are set programmatically,
+// and will never expire.
+type StaticProvider struct {
+	Value
+}
+
+// NewStaticCredentials returns a pointer to a new Credentials object
+// wrapping a static credentials value provider.
+func NewStaticCredentials(id, secret, token string) *Credentials {
+	return NewCredentials(&StaticProvider{Value: Value{
+		AccessKeyID:     id,
+		SecretAccessKey: secret,
+		SessionToken:    token,
+	}})
+}
+
+// NewStaticCredentialsFromCreds returns a pointer to a new Credentials object
+// wrapping the static credentials value provide. Same as NewStaticCredentials
+// but takes the creds Value instead of individual fields
+func NewStaticCredentialsFromCreds(creds Value) *Credentials {
+	return NewCredentials(&StaticProvider{Value: creds})
+}
+
+// Retrieve returns the credentials or error if the credentials are invalid.
+func (s *StaticProvider) Retrieve() (Value, error) {
+	if s.AccessKeyID == "" || s.SecretAccessKey == "" {
+		return Value{ProviderName: StaticProviderName}, ErrStaticCredentialsEmpty
+	}
+
+	if len(s.Value.ProviderName) == 0 {
+		s.Value.ProviderName = StaticProviderName
+	}
+	return s.Value, nil
+}
+
+// IsExpired returns if the credentials are expired.
+//
+// For StaticProvider, the credentials never expired.
+func (s *StaticProvider) IsExpired() bool {
+	return false
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/doc.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/doc.go
new file mode 100644
index 00000000..4fcb6161
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/doc.go
@@ -0,0 +1,56 @@
+// Package aws provides the core SDK's utilities and shared types. Use this package's
+// utilities to simplify setting and reading API operations parameters.
+//
+// Value and Pointer Conversion Utilities
+//
+// This package includes a helper conversion utility for each scalar type the SDK's
+// API use. These utilities make getting a pointer of the scalar, and dereferencing
+// a pointer easier.
+//
+// Each conversion utility comes in two forms. Value to Pointer and Pointer to Value.
+// The Pointer to value will safely dereference the pointer and return its value.
+// If the pointer was nil, the scalar's zero value will be returned.
+//
+// The value to pointer functions will be named after the scalar type. So get a
+// *string from a string value use the "String" function. This makes it easy to
+// to get pointer of a literal string value, because getting the address of a
+// literal requires assigning the value to a variable first.
+//
+//    var strPtr *string
+//
+//    // Without the SDK's conversion functions
+//    str := "my string"
+//    strPtr = &str
+//
+//    // With the SDK's conversion functions
+//    strPtr = aws.String("my string")
+//
+//    // Convert *string to string value
+//    str = aws.StringValue(strPtr)
+//
+// In addition to scalars the aws package also includes conversion utilities for
+// map and slice for commonly types used in API parameters. The map and slice
+// conversion functions use similar naming pattern as the scalar conversion
+// functions.
+//
+//    var strPtrs []*string
+//    var strs []string = []string{"Go", "Gophers", "Go"}
+//
+//    // Convert []string to []*string
+//    strPtrs = aws.StringSlice(strs)
+//
+//    // Convert []*string to []string
+//    strs = aws.StringValueSlice(strPtrs)
+//
+// SDK Default HTTP Client
+//
+// The SDK will use the http.DefaultClient if a HTTP client is not provided to
+// the SDK's Session, or service client constructor. This means that if the
+// http.DefaultClient is modified by other components of your application the
+// modifications will be picked up by the SDK as well.
+//
+// In some cases this might be intended, but it is a better practice to create
+// a custom HTTP Client to share explicitly through your application. You can
+// configure the SDK to use the custom HTTP Client by setting the HTTPClient
+// value of the SDK's Config type when creating a Session or service client.
+package aws
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/api.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/api.go
new file mode 100644
index 00000000..d57a1af5
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/api.go
@@ -0,0 +1,169 @@
+package ec2metadata
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/request"
+	"github.com/aws/aws-sdk-go/internal/sdkuri"
+)
+
+// GetMetadata uses the path provided to request information from the EC2
+// instance metdata service. The content will be returned as a string, or
+// error if the request failed.
+func (c *EC2Metadata) GetMetadata(p string) (string, error) {
+	op := &request.Operation{
+		Name:       "GetMetadata",
+		HTTPMethod: "GET",
+		HTTPPath:   sdkuri.PathJoin("/meta-data", p),
+	}
+
+	output := &metadataOutput{}
+	req := c.NewRequest(op, nil, output)
+	err := req.Send()
+
+	return output.Content, err
+}
+
+// GetUserData returns the userdata that was configured for the service. If
+// there is no user-data setup for the EC2 instance a "NotFoundError" error
+// code will be returned.
+func (c *EC2Metadata) GetUserData() (string, error) {
+	op := &request.Operation{
+		Name:       "GetUserData",
+		HTTPMethod: "GET",
+		HTTPPath:   "/user-data",
+	}
+
+	output := &metadataOutput{}
+	req := c.NewRequest(op, nil, output)
+	req.Handlers.UnmarshalError.PushBack(func(r *request.Request) {
+		if r.HTTPResponse.StatusCode == http.StatusNotFound {
+			r.Error = awserr.New("NotFoundError", "user-data not found", r.Error)
+		}
+	})
+	err := req.Send()
+
+	return output.Content, err
+}
+
+// GetDynamicData uses the path provided to request information from the EC2
+// instance metadata service for dynamic data. The content will be returned
+// as a string, or error if the request failed.
+func (c *EC2Metadata) GetDynamicData(p string) (string, error) {
+	op := &request.Operation{
+		Name:       "GetDynamicData",
+		HTTPMethod: "GET",
+		HTTPPath:   sdkuri.PathJoin("/dynamic", p),
+	}
+
+	output := &metadataOutput{}
+	req := c.NewRequest(op, nil, output)
+	err := req.Send()
+
+	return output.Content, err
+}
+
+// GetInstanceIdentityDocument retrieves an identity document describing an
+// instance. Error is returned if the request fails or is unable to parse
+// the response.
+func (c *EC2Metadata) GetInstanceIdentityDocument() (EC2InstanceIdentityDocument, error) {
+	resp, err := c.GetDynamicData("instance-identity/document")
+	if err != nil {
+		return EC2InstanceIdentityDocument{},
+			awserr.New("EC2MetadataRequestError",
+				"failed to get EC2 instance identity document", err)
+	}
+
+	doc := EC2InstanceIdentityDocument{}
+	if err := json.NewDecoder(strings.NewReader(resp)).Decode(&doc); err != nil {
+		return EC2InstanceIdentityDocument{},
+			awserr.New("SerializationError",
+				"failed to decode EC2 instance identity document", err)
+	}
+
+	return doc, nil
+}
+
+// IAMInfo retrieves IAM info from the metadata API
+func (c *EC2Metadata) IAMInfo() (EC2IAMInfo, error) {
+	resp, err := c.GetMetadata("iam/info")
+	if err != nil {
+		return EC2IAMInfo{},
+			awserr.New("EC2MetadataRequestError",
+				"failed to get EC2 IAM info", err)
+	}
+
+	info := EC2IAMInfo{}
+	if err := json.NewDecoder(strings.NewReader(resp)).Decode(&info); err != nil {
+		return EC2IAMInfo{},
+			awserr.New("SerializationError",
+				"failed to decode EC2 IAM info", err)
+	}
+
+	if info.Code != "Success" {
+		errMsg := fmt.Sprintf("failed to get EC2 IAM Info (%s)", info.Code)
+		return EC2IAMInfo{},
+			awserr.New("EC2MetadataError", errMsg, nil)
+	}
+
+	return info, nil
+}
+
+// Region returns the region the instance is running in.
+func (c *EC2Metadata) Region() (string, error) {
+	resp, err := c.GetMetadata("placement/availability-zone")
+	if err != nil {
+		return "", err
+	}
+
+	if len(resp) == 0 {
+		return "", awserr.New("EC2MetadataError", "invalid Region response", nil)
+	}
+
+	// returns region without the suffix. Eg: us-west-2a becomes us-west-2
+	return resp[:len(resp)-1], nil
+}
+
+// Available returns if the application has access to the EC2 Metadata service.
+// Can be used to determine if application is running within an EC2 Instance and
+// the metadata service is available.
+func (c *EC2Metadata) Available() bool {
+	if _, err := c.GetMetadata("instance-id"); err != nil {
+		return false
+	}
+
+	return true
+}
+
+// An EC2IAMInfo provides the shape for unmarshaling
+// an IAM info from the metadata API
+type EC2IAMInfo struct {
+	Code               string
+	LastUpdated        time.Time
+	InstanceProfileArn string
+	InstanceProfileID  string
+}
+
+// An EC2InstanceIdentityDocument provides the shape for unmarshaling
+// an instance identity document
+type EC2InstanceIdentityDocument struct {
+	DevpayProductCodes []string  `json:"devpayProductCodes"`
+	AvailabilityZone   string    `json:"availabilityZone"`
+	PrivateIP          string    `json:"privateIp"`
+	Version            string    `json:"version"`
+	Region             string    `json:"region"`
+	InstanceID         string    `json:"instanceId"`
+	BillingProducts    []string  `json:"billingProducts"`
+	InstanceType       string    `json:"instanceType"`
+	AccountID          string    `json:"accountId"`
+	PendingTime        time.Time `json:"pendingTime"`
+	ImageID            string    `json:"imageId"`
+	KernelID           string    `json:"kernelId"`
+	RamdiskID          string    `json:"ramdiskId"`
+	Architecture       string    `json:"architecture"`
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/service.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/service.go
new file mode 100644
index 00000000..f4438eae
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/service.go
@@ -0,0 +1,152 @@
+// Package ec2metadata provides the client for making API calls to the
+// EC2 Metadata service.
+//
+// This package's client can be disabled completely by setting the environment
+// variable "AWS_EC2_METADATA_DISABLED=true". This environment variable set to
+// true instructs the SDK to disable the EC2 Metadata client. The client cannot
+// be used while the environment variable is set to true, (case insensitive).
+package ec2metadata
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/client"
+	"github.com/aws/aws-sdk-go/aws/client/metadata"
+	"github.com/aws/aws-sdk-go/aws/corehandlers"
+	"github.com/aws/aws-sdk-go/aws/request"
+)
+
+// ServiceName is the name of the service.
+const ServiceName = "ec2metadata"
+const disableServiceEnvVar = "AWS_EC2_METADATA_DISABLED"
+
+// A EC2Metadata is an EC2 Metadata service Client.
+type EC2Metadata struct {
+	*client.Client
+}
+
+// New creates a new instance of the EC2Metadata client with a session.
+// This client is safe to use across multiple goroutines.
+//
+//
+// Example:
+//     // Create a EC2Metadata client from just a session.
+//     svc := ec2metadata.New(mySession)
+//
+//     // Create a EC2Metadata client with additional configuration
+//     svc := ec2metadata.New(mySession, aws.NewConfig().WithLogLevel(aws.LogDebugHTTPBody))
+func New(p client.ConfigProvider, cfgs ...*aws.Config) *EC2Metadata {
+	c := p.ClientConfig(ServiceName, cfgs...)
+	return NewClient(*c.Config, c.Handlers, c.Endpoint, c.SigningRegion)
+}
+
+// NewClient returns a new EC2Metadata client. Should be used to create
+// a client when not using a session. Generally using just New with a session
+// is preferred.
+//
+// If an unmodified HTTP client is provided from the stdlib default, or no client
+// the EC2RoleProvider's EC2Metadata HTTP client's timeout will be shortened.
+// To disable this set Config.EC2MetadataDisableTimeoutOverride to false. Enabled by default.
+func NewClient(cfg aws.Config, handlers request.Handlers, endpoint, signingRegion string, opts ...func(*client.Client)) *EC2Metadata {
+	if !aws.BoolValue(cfg.EC2MetadataDisableTimeoutOverride) && httpClientZero(cfg.HTTPClient) {
+		// If the http client is unmodified and this feature is not disabled
+		// set custom timeouts for EC2Metadata requests.
+		cfg.HTTPClient = &http.Client{
+			// use a shorter timeout than default because the metadata
+			// service is local if it is running, and to fail faster
+			// if not running on an ec2 instance.
+			Timeout: 5 * time.Second,
+		}
+	}
+
+	svc := &EC2Metadata{
+		Client: client.New(
+			cfg,
+			metadata.ClientInfo{
+				ServiceName: ServiceName,
+				ServiceID:   ServiceName,
+				Endpoint:    endpoint,
+				APIVersion:  "latest",
+			},
+			handlers,
+		),
+	}
+
+	svc.Handlers.Unmarshal.PushBack(unmarshalHandler)
+	svc.Handlers.UnmarshalError.PushBack(unmarshalError)
+	svc.Handlers.Validate.Clear()
+	svc.Handlers.Validate.PushBack(validateEndpointHandler)
+
+	// Disable the EC2 Metadata service if the environment variable is set.
+	// This shortcirctes the service's functionality to always fail to send
+	// requests.
+	if strings.ToLower(os.Getenv(disableServiceEnvVar)) == "true" {
+		svc.Handlers.Send.SwapNamed(request.NamedHandler{
+			Name: corehandlers.SendHandler.Name,
+			Fn: func(r *request.Request) {
+				r.HTTPResponse = &http.Response{
+					Header: http.Header{},
+				}
+				r.Error = awserr.New(
+					request.CanceledErrorCode,
+					"EC2 IMDS access disabled via "+disableServiceEnvVar+" env var",
+					nil)
+			},
+		})
+	}
+
+	// Add additional options to the service config
+	for _, option := range opts {
+		option(svc.Client)
+	}
+
+	return svc
+}
+
+func httpClientZero(c *http.Client) bool {
+	return c == nil || (c.Transport == nil && c.CheckRedirect == nil && c.Jar == nil && c.Timeout == 0)
+}
+
+type metadataOutput struct {
+	Content string
+}
+
+func unmarshalHandler(r *request.Request) {
+	defer r.HTTPResponse.Body.Close()
+	b := &bytes.Buffer{}
+	if _, err := io.Copy(b, r.HTTPResponse.Body); err != nil {
+		r.Error = awserr.New("SerializationError", "unable to unmarshal EC2 metadata respose", err)
+		return
+	}
+
+	if data, ok := r.Data.(*metadataOutput); ok {
+		data.Content = b.String()
+	}
+}
+
+func unmarshalError(r *request.Request) {
+	defer r.HTTPResponse.Body.Close()
+	b := &bytes.Buffer{}
+	if _, err := io.Copy(b, r.HTTPResponse.Body); err != nil {
+		r.Error = awserr.New("SerializationError", "unable to unmarshal EC2 metadata error respose", err)
+		return
+	}
+
+	// Response body format is not consistent between metadata endpoints.
+	// Grab the error message as a string and include that as the source error
+	r.Error = awserr.New("EC2MetadataError", "failed to make EC2Metadata request", errors.New(b.String()))
+}
+
+func validateEndpointHandler(r *request.Request) {
+	if r.ClientInfo.Endpoint == "" {
+		r.Error = aws.ErrMissingEndpoint
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/endpoints/decode.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/endpoints/decode.go
new file mode 100644
index 00000000..87b9ff3f
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/endpoints/decode.go
@@ -0,0 +1,188 @@
+package endpoints
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+
+	"github.com/aws/aws-sdk-go/aws/awserr"
+)
+
+type modelDefinition map[string]json.RawMessage
+
+// A DecodeModelOptions are the options for how the endpoints model definition
+// are decoded.
+type DecodeModelOptions struct {
+	SkipCustomizations bool
+}
+
+// Set combines all of the option functions together.
+func (d *DecodeModelOptions) Set(optFns ...func(*DecodeModelOptions)) {
+	for _, fn := range optFns {
+		fn(d)
+	}
+}
+
+// DecodeModel unmarshals a Regions and Endpoint model definition file into
+// a endpoint Resolver. If the file format is not supported, or an error occurs
+// when unmarshaling the model an error will be returned.
+//
+// Casting the return value of this func to a EnumPartitions will
+// allow you to get a list of the partitions in the order the endpoints
+// will be resolved in.
+//
+//    resolver, err := endpoints.DecodeModel(reader)
+//
+//    partitions := resolver.(endpoints.EnumPartitions).Partitions()
+//    for _, p := range partitions {
+//        // ... inspect partitions
+//    }
+func DecodeModel(r io.Reader, optFns ...func(*DecodeModelOptions)) (Resolver, error) {
+	var opts DecodeModelOptions
+	opts.Set(optFns...)
+
+	// Get the version of the partition file to determine what
+	// unmarshaling model to use.
+	modelDef := modelDefinition{}
+	if err := json.NewDecoder(r).Decode(&modelDef); err != nil {
+		return nil, newDecodeModelError("failed to decode endpoints model", err)
+	}
+
+	var version string
+	if b, ok := modelDef["version"]; ok {
+		version = string(b)
+	} else {
+		return nil, newDecodeModelError("endpoints version not found in model", nil)
+	}
+
+	if version == "3" {
+		return decodeV3Endpoints(modelDef, opts)
+	}
+
+	return nil, newDecodeModelError(
+		fmt.Sprintf("endpoints version %s, not supported", version), nil)
+}
+
+func decodeV3Endpoints(modelDef modelDefinition, opts DecodeModelOptions) (Resolver, error) {
+	b, ok := modelDef["partitions"]
+	if !ok {
+		return nil, newDecodeModelError("endpoints model missing partitions", nil)
+	}
+
+	ps := partitions{}
+	if err := json.Unmarshal(b, &ps); err != nil {
+		return nil, newDecodeModelError("failed to decode endpoints model", err)
+	}
+
+	if opts.SkipCustomizations {
+		return ps, nil
+	}
+
+	// Customization
+	for i := 0; i < len(ps); i++ {
+		p := &ps[i]
+		custAddEC2Metadata(p)
+		custAddS3DualStack(p)
+		custRmIotDataService(p)
+		custFixAppAutoscalingChina(p)
+		custFixAppAutoscalingUsGov(p)
+	}
+
+	return ps, nil
+}
+
+func custAddS3DualStack(p *partition) {
+	if p.ID != "aws" {
+		return
+	}
+
+	custAddDualstack(p, "s3")
+	custAddDualstack(p, "s3-control")
+}
+
+func custAddDualstack(p *partition, svcName string) {
+	s, ok := p.Services[svcName]
+	if !ok {
+		return
+	}
+
+	s.Defaults.HasDualStack = boxedTrue
+	s.Defaults.DualStackHostname = "{service}.dualstack.{region}.{dnsSuffix}"
+
+	p.Services[svcName] = s
+}
+
+func custAddEC2Metadata(p *partition) {
+	p.Services["ec2metadata"] = service{
+		IsRegionalized:    boxedFalse,
+		PartitionEndpoint: "aws-global",
+		Endpoints: endpoints{
+			"aws-global": endpoint{
+				Hostname:  "169.254.169.254/latest",
+				Protocols: []string{"http"},
+			},
+		},
+	}
+}
+
+func custRmIotDataService(p *partition) {
+	delete(p.Services, "data.iot")
+}
+
+func custFixAppAutoscalingChina(p *partition) {
+	if p.ID != "aws-cn" {
+		return
+	}
+
+	const serviceName = "application-autoscaling"
+	s, ok := p.Services[serviceName]
+	if !ok {
+		return
+	}
+
+	const expectHostname = `autoscaling.{region}.amazonaws.com`
+	if e, a := s.Defaults.Hostname, expectHostname; e != a {
+		fmt.Printf("custFixAppAutoscalingChina: ignoring customization, expected %s, got %s\n", e, a)
+		return
+	}
+
+	s.Defaults.Hostname = expectHostname + ".cn"
+	p.Services[serviceName] = s
+}
+
+func custFixAppAutoscalingUsGov(p *partition) {
+	if p.ID != "aws-us-gov" {
+		return
+	}
+
+	const serviceName = "application-autoscaling"
+	s, ok := p.Services[serviceName]
+	if !ok {
+		return
+	}
+
+	if a := s.Defaults.CredentialScope.Service; a != "" {
+		fmt.Printf("custFixAppAutoscalingUsGov: ignoring customization, expected empty credential scope service, got %s\n", a)
+		return
+	}
+
+	if a := s.Defaults.Hostname; a != "" {
+		fmt.Printf("custFixAppAutoscalingUsGov: ignoring customization, expected empty hostname, got %s\n", a)
+		return
+	}
+
+	s.Defaults.CredentialScope.Service = "application-autoscaling"
+	s.Defaults.Hostname = "autoscaling.{region}.amazonaws.com"
+
+	p.Services[serviceName] = s
+}
+
+type decodeModelError struct {
+	awsError
+}
+
+func newDecodeModelError(msg string, err error) decodeModelError {
+	return decodeModelError{
+		awsError: awserr.New("DecodeEndpointsModelError", msg, err),
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go
new file mode 100644
index 00000000..61bb980d
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go
@@ -0,0 +1,4103 @@
+// Code generated by aws/endpoints/v3model_codegen.go. DO NOT EDIT.
+
+package endpoints
+
+import (
+	"regexp"
+)
+
+// Partition identifiers
+const (
+	AwsPartitionID      = "aws"        // AWS Standard partition.
+	AwsCnPartitionID    = "aws-cn"     // AWS China partition.
+	AwsUsGovPartitionID = "aws-us-gov" // AWS GovCloud (US) partition.
+)
+
+// AWS Standard partition's regions.
+const (
+	ApNortheast1RegionID = "ap-northeast-1" // Asia Pacific (Tokyo).
+	ApNortheast2RegionID = "ap-northeast-2" // Asia Pacific (Seoul).
+	ApSouth1RegionID     = "ap-south-1"     // Asia Pacific (Mumbai).
+	ApSoutheast1RegionID = "ap-southeast-1" // Asia Pacific (Singapore).
+	ApSoutheast2RegionID = "ap-southeast-2" // Asia Pacific (Sydney).
+	CaCentral1RegionID   = "ca-central-1"   // Canada (Central).
+	EuCentral1RegionID   = "eu-central-1"   // EU (Frankfurt).
+	EuNorth1RegionID     = "eu-north-1"     // EU (Stockholm).
+	EuWest1RegionID      = "eu-west-1"      // EU (Ireland).
+	EuWest2RegionID      = "eu-west-2"      // EU (London).
+	EuWest3RegionID      = "eu-west-3"      // EU (Paris).
+	SaEast1RegionID      = "sa-east-1"      // South America (Sao Paulo).
+	UsEast1RegionID      = "us-east-1"      // US East (N. Virginia).
+	UsEast2RegionID      = "us-east-2"      // US East (Ohio).
+	UsWest1RegionID      = "us-west-1"      // US West (N. California).
+	UsWest2RegionID      = "us-west-2"      // US West (Oregon).
+)
+
+// AWS China partition's regions.
+const (
+	CnNorth1RegionID     = "cn-north-1"     // China (Beijing).
+	CnNorthwest1RegionID = "cn-northwest-1" // China (Ningxia).
+)
+
+// AWS GovCloud (US) partition's regions.
+const (
+	UsGovEast1RegionID = "us-gov-east-1" // AWS GovCloud (US-East).
+	UsGovWest1RegionID = "us-gov-west-1" // AWS GovCloud (US).
+)
+
+// DefaultResolver returns an Endpoint resolver that will be able
+// to resolve endpoints for: AWS Standard, AWS China, and AWS GovCloud (US).
+//
+// Use DefaultPartitions() to get the list of the default partitions.
+func DefaultResolver() Resolver {
+	return defaultPartitions
+}
+
+// DefaultPartitions returns a list of the partitions the SDK is bundled
+// with. The available partitions are: AWS Standard, AWS China, and AWS GovCloud (US).
+//
+//    partitions := endpoints.DefaultPartitions
+//    for _, p := range partitions {
+//        // ... inspect partitions
+//    }
+func DefaultPartitions() []Partition {
+	return defaultPartitions.Partitions()
+}
+
+var defaultPartitions = partitions{
+	awsPartition,
+	awscnPartition,
+	awsusgovPartition,
+}
+
+// AwsPartition returns the Resolver for AWS Standard.
+func AwsPartition() Partition {
+	return awsPartition.Partition()
+}
+
+var awsPartition = partition{
+	ID:        "aws",
+	Name:      "AWS Standard",
+	DNSSuffix: "amazonaws.com",
+	RegionRegex: regionRegex{
+		Regexp: func() *regexp.Regexp {
+			reg, _ := regexp.Compile("^(us|eu|ap|sa|ca)\\-\\w+\\-\\d+$")
+			return reg
+		}(),
+	},
+	Defaults: endpoint{
+		Hostname:          "{service}.{region}.{dnsSuffix}",
+		Protocols:         []string{"https"},
+		SignatureVersions: []string{"v4"},
+	},
+	Regions: regions{
+		"ap-northeast-1": region{
+			Description: "Asia Pacific (Tokyo)",
+		},
+		"ap-northeast-2": region{
+			Description: "Asia Pacific (Seoul)",
+		},
+		"ap-south-1": region{
+			Description: "Asia Pacific (Mumbai)",
+		},
+		"ap-southeast-1": region{
+			Description: "Asia Pacific (Singapore)",
+		},
+		"ap-southeast-2": region{
+			Description: "Asia Pacific (Sydney)",
+		},
+		"ca-central-1": region{
+			Description: "Canada (Central)",
+		},
+		"eu-central-1": region{
+			Description: "EU (Frankfurt)",
+		},
+		"eu-north-1": region{
+			Description: "EU (Stockholm)",
+		},
+		"eu-west-1": region{
+			Description: "EU (Ireland)",
+		},
+		"eu-west-2": region{
+			Description: "EU (London)",
+		},
+		"eu-west-3": region{
+			Description: "EU (Paris)",
+		},
+		"sa-east-1": region{
+			Description: "South America (Sao Paulo)",
+		},
+		"us-east-1": region{
+			Description: "US East (N. Virginia)",
+		},
+		"us-east-2": region{
+			Description: "US East (Ohio)",
+		},
+		"us-west-1": region{
+			Description: "US West (N. California)",
+		},
+		"us-west-2": region{
+			Description: "US West (Oregon)",
+		},
+	},
+	Services: services{
+		"a4b": service{
+
+			Endpoints: endpoints{
+				"us-east-1": endpoint{},
+			},
+		},
+		"acm": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"acm-pca": service{
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"api.ecr": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{
+					Hostname: "api.ecr.ap-northeast-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-northeast-1",
+					},
+				},
+				"ap-northeast-2": endpoint{
+					Hostname: "api.ecr.ap-northeast-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-northeast-2",
+					},
+				},
+				"ap-south-1": endpoint{
+					Hostname: "api.ecr.ap-south-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-south-1",
+					},
+				},
+				"ap-southeast-1": endpoint{
+					Hostname: "api.ecr.ap-southeast-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-southeast-1",
+					},
+				},
+				"ap-southeast-2": endpoint{
+					Hostname: "api.ecr.ap-southeast-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-southeast-2",
+					},
+				},
+				"ca-central-1": endpoint{
+					Hostname: "api.ecr.ca-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ca-central-1",
+					},
+				},
+				"eu-central-1": endpoint{
+					Hostname: "api.ecr.eu-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-central-1",
+					},
+				},
+				"eu-north-1": endpoint{
+					Hostname: "api.ecr.eu-north-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-north-1",
+					},
+				},
+				"eu-west-1": endpoint{
+					Hostname: "api.ecr.eu-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-west-1",
+					},
+				},
+				"eu-west-2": endpoint{
+					Hostname: "api.ecr.eu-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-west-2",
+					},
+				},
+				"eu-west-3": endpoint{
+					Hostname: "api.ecr.eu-west-3.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-west-3",
+					},
+				},
+				"sa-east-1": endpoint{
+					Hostname: "api.ecr.sa-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "sa-east-1",
+					},
+				},
+				"us-east-1": endpoint{
+					Hostname: "api.ecr.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"us-east-2": endpoint{
+					Hostname: "api.ecr.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"us-west-1": endpoint{
+					Hostname: "api.ecr.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+				},
+				"us-west-2": endpoint{
+					Hostname: "api.ecr.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+			},
+		},
+		"api.mediatailor": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"api.pricing": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "pricing",
+				},
+			},
+			Endpoints: endpoints{
+				"ap-south-1": endpoint{},
+				"us-east-1":  endpoint{},
+			},
+		},
+		"api.sagemaker": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-1-fips": endpoint{
+					Hostname: "api-fips.sagemaker.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"us-east-2": endpoint{},
+				"us-east-2-fips": endpoint{
+					Hostname: "api-fips.sagemaker.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"us-west-1": endpoint{},
+				"us-west-1-fips": endpoint{
+					Hostname: "api-fips.sagemaker.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+				},
+				"us-west-2": endpoint{},
+				"us-west-2-fips": endpoint{
+					Hostname: "api-fips.sagemaker.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+			},
+		},
+		"apigateway": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"application-autoscaling": service{
+			Defaults: endpoint{
+				Hostname:  "autoscaling.{region}.amazonaws.com",
+				Protocols: []string{"http", "https"},
+				CredentialScope: credentialScope{
+					Service: "application-autoscaling",
+				},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"appstream2": service{
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+				CredentialScope: credentialScope{
+					Service: "appstream",
+				},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"appsync": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"athena": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"autoscaling": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"autoscaling-plans": service{
+			Defaults: endpoint{
+				Hostname:  "autoscaling.{region}.amazonaws.com",
+				Protocols: []string{"http", "https"},
+				CredentialScope: credentialScope{
+					Service: "autoscaling-plans",
+				},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"batch": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"budgets": service{
+			PartitionEndpoint: "aws-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-global": endpoint{
+					Hostname: "budgets.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+			},
+		},
+		"ce": service{
+			PartitionEndpoint: "aws-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-global": endpoint{
+					Hostname: "ce.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+			},
+		},
+		"chime": service{
+			PartitionEndpoint: "aws-global",
+			IsRegionalized:    boxedFalse,
+			Defaults: endpoint{
+				SSLCommonName: "service.chime.aws.amazon.com",
+				Protocols:     []string{"https"},
+			},
+			Endpoints: endpoints{
+				"aws-global": endpoint{
+					Hostname:  "service.chime.aws.amazon.com",
+					Protocols: []string{"https"},
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+			},
+		},
+		"cloud9": service{
+
+			Endpoints: endpoints{
+				"ap-southeast-1": endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"clouddirectory": service{
+
+			Endpoints: endpoints{
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"cloudformation": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"cloudfront": service{
+			PartitionEndpoint: "aws-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-global": endpoint{
+					Hostname:  "cloudfront.amazonaws.com",
+					Protocols: []string{"http", "https"},
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+			},
+		},
+		"cloudhsm": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"cloudhsmv2": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "cloudhsm",
+				},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"cloudsearch": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"cloudtrail": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"codebuild": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-1-fips": endpoint{
+					Hostname: "codebuild-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"us-east-2": endpoint{},
+				"us-east-2-fips": endpoint{
+					Hostname: "codebuild-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"us-west-1": endpoint{},
+				"us-west-1-fips": endpoint{
+					Hostname: "codebuild-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+				},
+				"us-west-2": endpoint{},
+				"us-west-2-fips": endpoint{
+					Hostname: "codebuild-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+			},
+		},
+		"codecommit": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"fips": endpoint{
+					Hostname: "codecommit-fips.ca-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ca-central-1",
+					},
+				},
+				"sa-east-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-east-2": endpoint{},
+				"us-west-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"codedeploy": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-1-fips": endpoint{
+					Hostname: "codedeploy-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"us-east-2": endpoint{},
+				"us-east-2-fips": endpoint{
+					Hostname: "codedeploy-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"us-west-1": endpoint{},
+				"us-west-1-fips": endpoint{
+					Hostname: "codedeploy-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+				},
+				"us-west-2": endpoint{},
+				"us-west-2-fips": endpoint{
+					Hostname: "codedeploy-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+			},
+		},
+		"codepipeline": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"codestar": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"cognito-identity": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"cognito-idp": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"cognito-sync": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"comprehend": service{
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"comprehendmedical": service{
+
+			Endpoints: endpoints{
+				"eu-west-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-east-2": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"config": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"cur": service{
+
+			Endpoints: endpoints{
+				"us-east-1": endpoint{},
+			},
+		},
+		"datapipeline": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"datasync": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"dax": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"devicefarm": service{
+
+			Endpoints: endpoints{
+				"us-west-2": endpoint{},
+			},
+		},
+		"directconnect": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"discovery": service{
+
+			Endpoints: endpoints{
+				"us-west-2": endpoint{},
+			},
+		},
+		"dms": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"docdb": service{
+
+			Endpoints: endpoints{
+				"eu-west-1": endpoint{
+					Hostname: "rds.eu-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-west-1",
+					},
+				},
+				"us-east-1": endpoint{
+					Hostname: "rds.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"us-east-2": endpoint{
+					Hostname: "rds.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"us-west-2": endpoint{
+					Hostname: "rds.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+			},
+		},
+		"ds": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"dynamodb": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"local": endpoint{
+					Hostname:  "localhost:8000",
+					Protocols: []string{"http"},
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"sa-east-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-east-2": endpoint{},
+				"us-west-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"ec2": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"ec2metadata": service{
+			PartitionEndpoint: "aws-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-global": endpoint{
+					Hostname:  "169.254.169.254/latest",
+					Protocols: []string{"http"},
+				},
+			},
+		},
+		"ecs": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"elasticache": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"fips": endpoint{
+					Hostname: "elasticache-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+				},
+				"sa-east-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-east-2": endpoint{},
+				"us-west-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"elasticbeanstalk": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"elasticfilesystem": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"elasticloadbalancing": service{
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"elasticmapreduce": service{
+			Defaults: endpoint{
+				SSLCommonName: "{region}.{service}.{dnsSuffix}",
+				Protocols:     []string{"https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1": endpoint{
+					SSLCommonName: "{service}.{region}.{dnsSuffix}",
+				},
+				"eu-north-1": endpoint{},
+				"eu-west-1":  endpoint{},
+				"eu-west-2":  endpoint{},
+				"eu-west-3":  endpoint{},
+				"sa-east-1":  endpoint{},
+				"us-east-1": endpoint{
+					SSLCommonName: "{service}.{region}.{dnsSuffix}",
+				},
+				"us-east-2": endpoint{},
+				"us-west-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"elastictranscoder": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"email": service{
+
+			Endpoints: endpoints{
+				"eu-west-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"entitlement.marketplace": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "aws-marketplace",
+				},
+			},
+			Endpoints: endpoints{
+				"us-east-1": endpoint{},
+			},
+		},
+		"es": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"fips": endpoint{
+					Hostname: "es-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+				},
+				"sa-east-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-east-2": endpoint{},
+				"us-west-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"events": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"firehose": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"fms": service{
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"fsx": service{
+
+			Endpoints: endpoints{
+				"eu-west-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-east-2": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"gamelift": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"glacier": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"glue": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"greengrass": service{
+			IsRegionalized: boxedTrue,
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"guardduty": service{
+			IsRegionalized: boxedTrue,
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"health": service{
+
+			Endpoints: endpoints{
+				"us-east-1": endpoint{},
+			},
+		},
+		"iam": service{
+			PartitionEndpoint: "aws-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-global": endpoint{
+					Hostname: "iam.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+			},
+		},
+		"importexport": service{
+			PartitionEndpoint: "aws-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-global": endpoint{
+					Hostname:          "importexport.amazonaws.com",
+					SignatureVersions: []string{"v2", "v4"},
+					CredentialScope: credentialScope{
+						Region:  "us-east-1",
+						Service: "IngestionService",
+					},
+				},
+			},
+		},
+		"inspector": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"iot": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "execute-api",
+				},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"iotanalytics": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"kinesis": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"kinesisanalytics": service{
+
+			Endpoints: endpoints{
+				"eu-central-1": endpoint{},
+				"eu-west-1":    endpoint{},
+				"us-east-1":    endpoint{},
+				"us-east-2":    endpoint{},
+				"us-west-2":    endpoint{},
+			},
+		},
+		"kinesisvideo": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"kms": service{
+
+			Endpoints: endpoints{
+				"ProdFips": endpoint{
+					Hostname: "kms-fips.ca-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ca-central-1",
+					},
+				},
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"lambda": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"license-manager": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"lightsail": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"logs": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"machinelearning": service{
+
+			Endpoints: endpoints{
+				"eu-west-1": endpoint{},
+				"us-east-1": endpoint{},
+			},
+		},
+		"marketplacecommerceanalytics": service{
+
+			Endpoints: endpoints{
+				"us-east-1": endpoint{},
+			},
+		},
+		"mediaconvert": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"medialive": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"mediapackage": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"mediastore": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"metering.marketplace": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "aws-marketplace",
+				},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"mgh": service{
+
+			Endpoints: endpoints{
+				"us-west-2": endpoint{},
+			},
+		},
+		"mobileanalytics": service{
+
+			Endpoints: endpoints{
+				"us-east-1": endpoint{},
+			},
+		},
+		"models.lex": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "lex",
+				},
+			},
+			Endpoints: endpoints{
+				"eu-west-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"monitoring": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"mq": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"mturk-requester": service{
+			IsRegionalized: boxedFalse,
+
+			Endpoints: endpoints{
+				"sandbox": endpoint{
+					Hostname: "mturk-requester-sandbox.us-east-1.amazonaws.com",
+				},
+				"us-east-1": endpoint{},
+			},
+		},
+		"neptune": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{
+					Hostname: "rds.ap-northeast-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-northeast-1",
+					},
+				},
+				"ap-southeast-1": endpoint{
+					Hostname: "rds.ap-southeast-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-southeast-1",
+					},
+				},
+				"ap-southeast-2": endpoint{
+					Hostname: "rds.ap-southeast-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-southeast-2",
+					},
+				},
+				"eu-central-1": endpoint{
+					Hostname: "rds.eu-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-central-1",
+					},
+				},
+				"eu-west-1": endpoint{
+					Hostname: "rds.eu-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-west-1",
+					},
+				},
+				"eu-west-2": endpoint{
+					Hostname: "rds.eu-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-west-2",
+					},
+				},
+				"us-east-1": endpoint{
+					Hostname: "rds.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"us-east-2": endpoint{
+					Hostname: "rds.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"us-west-2": endpoint{
+					Hostname: "rds.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+			},
+		},
+		"opsworks": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"opsworks-cm": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"organizations": service{
+			PartitionEndpoint: "aws-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-global": endpoint{
+					Hostname: "organizations.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+			},
+		},
+		"pinpoint": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "mobiletargeting",
+				},
+			},
+			Endpoints: endpoints{
+				"eu-central-1": endpoint{},
+				"eu-west-1":    endpoint{},
+				"us-east-1":    endpoint{},
+				"us-west-2":    endpoint{},
+			},
+		},
+		"polly": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"rds": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1": endpoint{
+					SSLCommonName: "{service}.{dnsSuffix}",
+				},
+				"us-east-2": endpoint{},
+				"us-west-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"redshift": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"rekognition": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"resource-groups": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"robomaker": service{
+
+			Endpoints: endpoints{
+				"eu-west-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"route53": service{
+			PartitionEndpoint: "aws-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-global": endpoint{
+					Hostname: "route53.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+			},
+		},
+		"route53domains": service{
+
+			Endpoints: endpoints{
+				"us-east-1": endpoint{},
+			},
+		},
+		"route53resolver": service{
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"runtime.lex": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "lex",
+				},
+			},
+			Endpoints: endpoints{
+				"eu-west-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"runtime.sagemaker": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"s3": service{
+			PartitionEndpoint: "us-east-1",
+			IsRegionalized:    boxedTrue,
+			Defaults: endpoint{
+				Protocols:         []string{"http", "https"},
+				SignatureVersions: []string{"s3v4"},
+
+				HasDualStack:      boxedTrue,
+				DualStackHostname: "{service}.dualstack.{region}.{dnsSuffix}",
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{
+					Hostname:          "s3.ap-northeast-1.amazonaws.com",
+					SignatureVersions: []string{"s3", "s3v4"},
+				},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{
+					Hostname:          "s3.ap-southeast-1.amazonaws.com",
+					SignatureVersions: []string{"s3", "s3v4"},
+				},
+				"ap-southeast-2": endpoint{
+					Hostname:          "s3.ap-southeast-2.amazonaws.com",
+					SignatureVersions: []string{"s3", "s3v4"},
+				},
+				"ca-central-1": endpoint{},
+				"eu-central-1": endpoint{},
+				"eu-north-1":   endpoint{},
+				"eu-west-1": endpoint{
+					Hostname:          "s3.eu-west-1.amazonaws.com",
+					SignatureVersions: []string{"s3", "s3v4"},
+				},
+				"eu-west-2": endpoint{},
+				"eu-west-3": endpoint{},
+				"s3-external-1": endpoint{
+					Hostname:          "s3-external-1.amazonaws.com",
+					SignatureVersions: []string{"s3", "s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"sa-east-1": endpoint{
+					Hostname:          "s3.sa-east-1.amazonaws.com",
+					SignatureVersions: []string{"s3", "s3v4"},
+				},
+				"us-east-1": endpoint{
+					Hostname:          "s3.amazonaws.com",
+					SignatureVersions: []string{"s3", "s3v4"},
+				},
+				"us-east-2": endpoint{},
+				"us-west-1": endpoint{
+					Hostname:          "s3.us-west-1.amazonaws.com",
+					SignatureVersions: []string{"s3", "s3v4"},
+				},
+				"us-west-2": endpoint{
+					Hostname:          "s3.us-west-2.amazonaws.com",
+					SignatureVersions: []string{"s3", "s3v4"},
+				},
+			},
+		},
+		"s3-control": service{
+			Defaults: endpoint{
+				Protocols:         []string{"https"},
+				SignatureVersions: []string{"s3v4"},
+
+				HasDualStack:      boxedTrue,
+				DualStackHostname: "{service}.dualstack.{region}.{dnsSuffix}",
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{
+					Hostname:          "s3-control.ap-northeast-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "ap-northeast-1",
+					},
+				},
+				"ap-northeast-2": endpoint{
+					Hostname:          "s3-control.ap-northeast-2.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "ap-northeast-2",
+					},
+				},
+				"ap-south-1": endpoint{
+					Hostname:          "s3-control.ap-south-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "ap-south-1",
+					},
+				},
+				"ap-southeast-1": endpoint{
+					Hostname:          "s3-control.ap-southeast-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "ap-southeast-1",
+					},
+				},
+				"ap-southeast-2": endpoint{
+					Hostname:          "s3-control.ap-southeast-2.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "ap-southeast-2",
+					},
+				},
+				"ca-central-1": endpoint{
+					Hostname:          "s3-control.ca-central-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "ca-central-1",
+					},
+				},
+				"eu-central-1": endpoint{
+					Hostname:          "s3-control.eu-central-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "eu-central-1",
+					},
+				},
+				"eu-north-1": endpoint{
+					Hostname:          "s3-control.eu-north-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "eu-north-1",
+					},
+				},
+				"eu-west-1": endpoint{
+					Hostname:          "s3-control.eu-west-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "eu-west-1",
+					},
+				},
+				"eu-west-2": endpoint{
+					Hostname:          "s3-control.eu-west-2.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "eu-west-2",
+					},
+				},
+				"eu-west-3": endpoint{
+					Hostname:          "s3-control.eu-west-3.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "eu-west-3",
+					},
+				},
+				"sa-east-1": endpoint{
+					Hostname:          "s3-control.sa-east-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "sa-east-1",
+					},
+				},
+				"us-east-1": endpoint{
+					Hostname:          "s3-control.us-east-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"us-east-1-fips": endpoint{
+					Hostname:          "s3-control-fips.us-east-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"us-east-2": endpoint{
+					Hostname:          "s3-control.us-east-2.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"us-east-2-fips": endpoint{
+					Hostname:          "s3-control-fips.us-east-2.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"us-west-1": endpoint{
+					Hostname:          "s3-control.us-west-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+				},
+				"us-west-1-fips": endpoint{
+					Hostname:          "s3-control-fips.us-west-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+				},
+				"us-west-2": endpoint{
+					Hostname:          "s3-control.us-west-2.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+				"us-west-2-fips": endpoint{
+					Hostname:          "s3-control-fips.us-west-2.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+			},
+		},
+		"sdb": service{
+			Defaults: endpoint{
+				Protocols:         []string{"http", "https"},
+				SignatureVersions: []string{"v2"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-west-1":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1": endpoint{
+					Hostname: "sdb.amazonaws.com",
+				},
+				"us-west-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"secretsmanager": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-1-fips": endpoint{
+					Hostname: "secretsmanager-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"us-east-2": endpoint{},
+				"us-east-2-fips": endpoint{
+					Hostname: "secretsmanager-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"us-west-1": endpoint{},
+				"us-west-1-fips": endpoint{
+					Hostname: "secretsmanager-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+				},
+				"us-west-2": endpoint{},
+				"us-west-2-fips": endpoint{
+					Hostname: "secretsmanager-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+			},
+		},
+		"securityhub": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"serverlessrepo": service{
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{
+					Protocols: []string{"https"},
+				},
+				"ap-northeast-2": endpoint{
+					Protocols: []string{"https"},
+				},
+				"ap-south-1": endpoint{
+					Protocols: []string{"https"},
+				},
+				"ap-southeast-1": endpoint{
+					Protocols: []string{"https"},
+				},
+				"ap-southeast-2": endpoint{
+					Protocols: []string{"https"},
+				},
+				"ca-central-1": endpoint{
+					Protocols: []string{"https"},
+				},
+				"eu-central-1": endpoint{
+					Protocols: []string{"https"},
+				},
+				"eu-west-1": endpoint{
+					Protocols: []string{"https"},
+				},
+				"eu-west-2": endpoint{
+					Protocols: []string{"https"},
+				},
+				"sa-east-1": endpoint{
+					Protocols: []string{"https"},
+				},
+				"us-east-1": endpoint{
+					Protocols: []string{"https"},
+				},
+				"us-east-2": endpoint{
+					Protocols: []string{"https"},
+				},
+				"us-west-1": endpoint{
+					Protocols: []string{"https"},
+				},
+				"us-west-2": endpoint{
+					Protocols: []string{"https"},
+				},
+			},
+		},
+		"servicecatalog": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-1-fips": endpoint{
+					Hostname: "servicecatalog-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"us-east-2": endpoint{},
+				"us-east-2-fips": endpoint{
+					Hostname: "servicecatalog-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"us-west-1": endpoint{},
+				"us-west-1-fips": endpoint{
+					Hostname: "servicecatalog-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+				},
+				"us-west-2": endpoint{},
+				"us-west-2-fips": endpoint{
+					Hostname: "servicecatalog-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+			},
+		},
+		"servicediscovery": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"shield": service{
+			IsRegionalized: boxedFalse,
+			Defaults: endpoint{
+				SSLCommonName: "shield.us-east-1.amazonaws.com",
+				Protocols:     []string{"https"},
+			},
+			Endpoints: endpoints{
+				"us-east-1": endpoint{},
+			},
+		},
+		"sms": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"snowball": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"sns": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"sqs": service{
+			Defaults: endpoint{
+				SSLCommonName: "{region}.queue.{dnsSuffix}",
+				Protocols:     []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"fips-us-east-1": endpoint{
+					Hostname: "sqs-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"fips-us-east-2": endpoint{
+					Hostname: "sqs-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"fips-us-west-1": endpoint{
+					Hostname: "sqs-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+				},
+				"fips-us-west-2": endpoint{
+					Hostname: "sqs-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+				"sa-east-1": endpoint{},
+				"us-east-1": endpoint{
+					SSLCommonName: "queue.{dnsSuffix}",
+				},
+				"us-east-2": endpoint{},
+				"us-west-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"ssm": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"states": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"storagegateway": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"streams.dynamodb": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+				CredentialScope: credentialScope{
+					Service: "dynamodb",
+				},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"local": endpoint{
+					Hostname:  "localhost:8000",
+					Protocols: []string{"http"},
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"sa-east-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-east-2": endpoint{},
+				"us-west-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"sts": service{
+			PartitionEndpoint: "aws-global",
+			Defaults: endpoint{
+				Hostname: "sts.amazonaws.com",
+				CredentialScope: credentialScope{
+					Region: "us-east-1",
+				},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{
+					Hostname: "sts.ap-northeast-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-northeast-2",
+					},
+				},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"aws-global":     endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-1-fips": endpoint{
+					Hostname: "sts-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"us-east-2": endpoint{},
+				"us-east-2-fips": endpoint{
+					Hostname: "sts-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"us-west-1": endpoint{},
+				"us-west-1-fips": endpoint{
+					Hostname: "sts-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+				},
+				"us-west-2": endpoint{},
+				"us-west-2-fips": endpoint{
+					Hostname: "sts-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+			},
+		},
+		"support": service{
+
+			Endpoints: endpoints{
+				"us-east-1": endpoint{},
+			},
+		},
+		"swf": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"tagging": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"transfer": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"translate": service{
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"eu-west-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-east-1-fips": endpoint{
+					Hostname: "translate-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"us-east-2": endpoint{},
+				"us-east-2-fips": endpoint{
+					Hostname: "translate-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"us-west-2": endpoint{},
+				"us-west-2-fips": endpoint{
+					Hostname: "translate-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+			},
+		},
+		"waf": service{
+			PartitionEndpoint: "aws-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-global": endpoint{
+					Hostname: "waf.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+			},
+		},
+		"waf-regional": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"workdocs": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"workmail": service{
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"eu-west-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"workspaces": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"xray": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+	},
+}
+
+// AwsCnPartition returns the Resolver for AWS China.
+func AwsCnPartition() Partition {
+	return awscnPartition.Partition()
+}
+
+var awscnPartition = partition{
+	ID:        "aws-cn",
+	Name:      "AWS China",
+	DNSSuffix: "amazonaws.com.cn",
+	RegionRegex: regionRegex{
+		Regexp: func() *regexp.Regexp {
+			reg, _ := regexp.Compile("^cn\\-\\w+\\-\\d+$")
+			return reg
+		}(),
+	},
+	Defaults: endpoint{
+		Hostname:          "{service}.{region}.{dnsSuffix}",
+		Protocols:         []string{"https"},
+		SignatureVersions: []string{"v4"},
+	},
+	Regions: regions{
+		"cn-north-1": region{
+			Description: "China (Beijing)",
+		},
+		"cn-northwest-1": region{
+			Description: "China (Ningxia)",
+		},
+	},
+	Services: services{
+		"api.ecr": service{
+
+			Endpoints: endpoints{
+				"cn-north-1": endpoint{
+					Hostname: "api.ecr.cn-north-1.amazonaws.com.cn",
+					CredentialScope: credentialScope{
+						Region: "cn-north-1",
+					},
+				},
+				"cn-northwest-1": endpoint{
+					Hostname: "api.ecr.cn-northwest-1.amazonaws.com.cn",
+					CredentialScope: credentialScope{
+						Region: "cn-northwest-1",
+					},
+				},
+			},
+		},
+		"apigateway": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"application-autoscaling": service{
+			Defaults: endpoint{
+				Hostname:  "autoscaling.{region}.amazonaws.com.cn",
+				Protocols: []string{"http", "https"},
+				CredentialScope: credentialScope{
+					Service: "application-autoscaling",
+				},
+			},
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"autoscaling": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"cloudformation": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"cloudtrail": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"codebuild": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"codedeploy": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"cognito-identity": service{
+
+			Endpoints: endpoints{
+				"cn-north-1": endpoint{},
+			},
+		},
+		"config": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"directconnect": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"dms": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"ds": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"dynamodb": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"ec2": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"ec2metadata": service{
+			PartitionEndpoint: "aws-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-global": endpoint{
+					Hostname:  "169.254.169.254/latest",
+					Protocols: []string{"http"},
+				},
+			},
+		},
+		"ecs": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"elasticache": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"elasticbeanstalk": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"elasticloadbalancing": service{
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"elasticmapreduce": service{
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"es": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"events": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"firehose": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"gamelift": service{
+
+			Endpoints: endpoints{
+				"cn-north-1": endpoint{},
+			},
+		},
+		"glacier": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"iam": service{
+			PartitionEndpoint: "aws-cn-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-cn-global": endpoint{
+					Hostname: "iam.cn-north-1.amazonaws.com.cn",
+					CredentialScope: credentialScope{
+						Region: "cn-north-1",
+					},
+				},
+			},
+		},
+		"iot": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "execute-api",
+				},
+			},
+			Endpoints: endpoints{
+				"cn-north-1": endpoint{},
+			},
+		},
+		"kinesis": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"lambda": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"logs": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"monitoring": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"polly": service{
+
+			Endpoints: endpoints{
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"rds": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"redshift": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"s3": service{
+			Defaults: endpoint{
+				Protocols:         []string{"http", "https"},
+				SignatureVersions: []string{"s3v4"},
+			},
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"s3-control": service{
+			Defaults: endpoint{
+				Protocols:         []string{"https"},
+				SignatureVersions: []string{"s3v4"},
+			},
+			Endpoints: endpoints{
+				"cn-north-1": endpoint{
+					Hostname:          "s3-control.cn-north-1.amazonaws.com.cn",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "cn-north-1",
+					},
+				},
+				"cn-northwest-1": endpoint{
+					Hostname:          "s3-control.cn-northwest-1.amazonaws.com.cn",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "cn-northwest-1",
+					},
+				},
+			},
+		},
+		"sms": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"snowball": service{
+
+			Endpoints: endpoints{
+				"cn-north-1": endpoint{},
+			},
+		},
+		"sns": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"sqs": service{
+			Defaults: endpoint{
+				SSLCommonName: "{region}.queue.{dnsSuffix}",
+				Protocols:     []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"ssm": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"states": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"storagegateway": service{
+
+			Endpoints: endpoints{
+				"cn-north-1": endpoint{},
+			},
+		},
+		"streams.dynamodb": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+				CredentialScope: credentialScope{
+					Service: "dynamodb",
+				},
+			},
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"sts": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"swf": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"tagging": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+	},
+}
+
+// AwsUsGovPartition returns the Resolver for AWS GovCloud (US).
+func AwsUsGovPartition() Partition {
+	return awsusgovPartition.Partition()
+}
+
+var awsusgovPartition = partition{
+	ID:        "aws-us-gov",
+	Name:      "AWS GovCloud (US)",
+	DNSSuffix: "amazonaws.com",
+	RegionRegex: regionRegex{
+		Regexp: func() *regexp.Regexp {
+			reg, _ := regexp.Compile("^us\\-gov\\-\\w+\\-\\d+$")
+			return reg
+		}(),
+	},
+	Defaults: endpoint{
+		Hostname:          "{service}.{region}.{dnsSuffix}",
+		Protocols:         []string{"https"},
+		SignatureVersions: []string{"v4"},
+	},
+	Regions: regions{
+		"us-gov-east-1": region{
+			Description: "AWS GovCloud (US-East)",
+		},
+		"us-gov-west-1": region{
+			Description: "AWS GovCloud (US)",
+		},
+	},
+	Services: services{
+		"acm": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"api.ecr": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{
+					Hostname: "api.ecr.us-gov-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-east-1",
+					},
+				},
+				"us-gov-west-1": endpoint{
+					Hostname: "api.ecr.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+			},
+		},
+		"api.sagemaker": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"apigateway": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"application-autoscaling": service{
+			Defaults: endpoint{
+				Hostname: "autoscaling.{region}.amazonaws.com",
+				CredentialScope: credentialScope{
+					Service: "application-autoscaling",
+				},
+			},
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"athena": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"autoscaling": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{
+					Protocols: []string{"http", "https"},
+				},
+			},
+		},
+		"clouddirectory": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"cloudformation": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"cloudhsm": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"cloudhsmv2": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "cloudhsm",
+				},
+			},
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"cloudtrail": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"codedeploy": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-east-1-fips": endpoint{
+					Hostname: "codedeploy-fips.us-gov-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-east-1",
+					},
+				},
+				"us-gov-west-1": endpoint{},
+				"us-gov-west-1-fips": endpoint{
+					Hostname: "codedeploy-fips.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+			},
+		},
+		"config": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"directconnect": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"dms": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"ds": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"dynamodb": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+				"us-gov-west-1-fips": endpoint{
+					Hostname: "dynamodb.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+			},
+		},
+		"ec2": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"ec2metadata": service{
+			PartitionEndpoint: "aws-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-global": endpoint{
+					Hostname:  "169.254.169.254/latest",
+					Protocols: []string{"http"},
+				},
+			},
+		},
+		"ecs": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"elasticache": service{
+
+			Endpoints: endpoints{
+				"fips": endpoint{
+					Hostname: "elasticache-fips.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"elasticbeanstalk": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"elasticfilesystem": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"elasticloadbalancing": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{
+					Protocols: []string{"http", "https"},
+				},
+			},
+		},
+		"elasticmapreduce": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{
+					Protocols: []string{"https"},
+				},
+			},
+		},
+		"es": service{
+
+			Endpoints: endpoints{
+				"fips": endpoint{
+					Hostname: "es-fips.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"events": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"firehose": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"glacier": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{
+					Protocols: []string{"http", "https"},
+				},
+			},
+		},
+		"glue": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"guardduty": service{
+			IsRegionalized: boxedTrue,
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"iam": service{
+			PartitionEndpoint: "aws-us-gov-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-us-gov-global": endpoint{
+					Hostname: "iam.us-gov.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+			},
+		},
+		"inspector": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"iot": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "execute-api",
+				},
+			},
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"kinesis": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"kms": service{
+
+			Endpoints: endpoints{
+				"ProdFips": endpoint{
+					Hostname: "kms-fips.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"lambda": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"logs": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"mediaconvert": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"metering.marketplace": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "aws-marketplace",
+				},
+			},
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"monitoring": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"polly": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"rds": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"redshift": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"rekognition": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"runtime.sagemaker": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"s3": service{
+			Defaults: endpoint{
+				SignatureVersions: []string{"s3", "s3v4"},
+			},
+			Endpoints: endpoints{
+				"fips-us-gov-west-1": endpoint{
+					Hostname: "s3-fips-us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+				"us-gov-east-1": endpoint{
+					Hostname:  "s3.us-gov-east-1.amazonaws.com",
+					Protocols: []string{"http", "https"},
+				},
+				"us-gov-west-1": endpoint{
+					Hostname:  "s3.us-gov-west-1.amazonaws.com",
+					Protocols: []string{"http", "https"},
+				},
+			},
+		},
+		"s3-control": service{
+			Defaults: endpoint{
+				Protocols:         []string{"https"},
+				SignatureVersions: []string{"s3v4"},
+			},
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{
+					Hostname:          "s3-control.us-gov-east-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-gov-east-1",
+					},
+				},
+				"us-gov-east-1-fips": endpoint{
+					Hostname:          "s3-control-fips.us-gov-east-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-gov-east-1",
+					},
+				},
+				"us-gov-west-1": endpoint{
+					Hostname:          "s3-control.us-gov-west-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+				"us-gov-west-1-fips": endpoint{
+					Hostname:          "s3-control-fips.us-gov-west-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+			},
+		},
+		"sms": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"snowball": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"sns": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{
+					Protocols: []string{"http", "https"},
+				},
+			},
+		},
+		"sqs": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{
+					SSLCommonName: "{region}.queue.{dnsSuffix}",
+					Protocols:     []string{"http", "https"},
+				},
+			},
+		},
+		"ssm": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"states": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"storagegateway": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"streams.dynamodb": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "dynamodb",
+				},
+			},
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+				"us-gov-west-1-fips": endpoint{
+					Hostname: "dynamodb.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+			},
+		},
+		"sts": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"swf": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"tagging": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"translate": service{
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+				"us-gov-west-1-fips": endpoint{
+					Hostname: "translate-fips.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+			},
+		},
+		"workspaces": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+	},
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/endpoints/dep_service_ids.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/endpoints/dep_service_ids.go
new file mode 100644
index 00000000..000dd79e
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/endpoints/dep_service_ids.go
@@ -0,0 +1,141 @@
+package endpoints
+
+// Service identifiers
+//
+// Deprecated: Use client package's EndpointID value instead of these
+// ServiceIDs. These IDs are not maintained, and are out of date.
+const (
+	A4bServiceID                          = "a4b"                          // A4b.
+	AcmServiceID                          = "acm"                          // Acm.
+	AcmPcaServiceID                       = "acm-pca"                      // AcmPca.
+	ApiMediatailorServiceID               = "api.mediatailor"              // ApiMediatailor.
+	ApiPricingServiceID                   = "api.pricing"                  // ApiPricing.
+	ApiSagemakerServiceID                 = "api.sagemaker"                // ApiSagemaker.
+	ApigatewayServiceID                   = "apigateway"                   // Apigateway.
+	ApplicationAutoscalingServiceID       = "application-autoscaling"      // ApplicationAutoscaling.
+	Appstream2ServiceID                   = "appstream2"                   // Appstream2.
+	AppsyncServiceID                      = "appsync"                      // Appsync.
+	AthenaServiceID                       = "athena"                       // Athena.
+	AutoscalingServiceID                  = "autoscaling"                  // Autoscaling.
+	AutoscalingPlansServiceID             = "autoscaling-plans"            // AutoscalingPlans.
+	BatchServiceID                        = "batch"                        // Batch.
+	BudgetsServiceID                      = "budgets"                      // Budgets.
+	CeServiceID                           = "ce"                           // Ce.
+	ChimeServiceID                        = "chime"                        // Chime.
+	Cloud9ServiceID                       = "cloud9"                       // Cloud9.
+	ClouddirectoryServiceID               = "clouddirectory"               // Clouddirectory.
+	CloudformationServiceID               = "cloudformation"               // Cloudformation.
+	CloudfrontServiceID                   = "cloudfront"                   // Cloudfront.
+	CloudhsmServiceID                     = "cloudhsm"                     // Cloudhsm.
+	Cloudhsmv2ServiceID                   = "cloudhsmv2"                   // Cloudhsmv2.
+	CloudsearchServiceID                  = "cloudsearch"                  // Cloudsearch.
+	CloudtrailServiceID                   = "cloudtrail"                   // Cloudtrail.
+	CodebuildServiceID                    = "codebuild"                    // Codebuild.
+	CodecommitServiceID                   = "codecommit"                   // Codecommit.
+	CodedeployServiceID                   = "codedeploy"                   // Codedeploy.
+	CodepipelineServiceID                 = "codepipeline"                 // Codepipeline.
+	CodestarServiceID                     = "codestar"                     // Codestar.
+	CognitoIdentityServiceID              = "cognito-identity"             // CognitoIdentity.
+	CognitoIdpServiceID                   = "cognito-idp"                  // CognitoIdp.
+	CognitoSyncServiceID                  = "cognito-sync"                 // CognitoSync.
+	ComprehendServiceID                   = "comprehend"                   // Comprehend.
+	ConfigServiceID                       = "config"                       // Config.
+	CurServiceID                          = "cur"                          // Cur.
+	DatapipelineServiceID                 = "datapipeline"                 // Datapipeline.
+	DaxServiceID                          = "dax"                          // Dax.
+	DevicefarmServiceID                   = "devicefarm"                   // Devicefarm.
+	DirectconnectServiceID                = "directconnect"                // Directconnect.
+	DiscoveryServiceID                    = "discovery"                    // Discovery.
+	DmsServiceID                          = "dms"                          // Dms.
+	DsServiceID                           = "ds"                           // Ds.
+	DynamodbServiceID                     = "dynamodb"                     // Dynamodb.
+	Ec2ServiceID                          = "ec2"                          // Ec2.
+	Ec2metadataServiceID                  = "ec2metadata"                  // Ec2metadata.
+	EcrServiceID                          = "ecr"                          // Ecr.
+	EcsServiceID                          = "ecs"                          // Ecs.
+	ElasticacheServiceID                  = "elasticache"                  // Elasticache.
+	ElasticbeanstalkServiceID             = "elasticbeanstalk"             // Elasticbeanstalk.
+	ElasticfilesystemServiceID            = "elasticfilesystem"            // Elasticfilesystem.
+	ElasticloadbalancingServiceID         = "elasticloadbalancing"         // Elasticloadbalancing.
+	ElasticmapreduceServiceID             = "elasticmapreduce"             // Elasticmapreduce.
+	ElastictranscoderServiceID            = "elastictranscoder"            // Elastictranscoder.
+	EmailServiceID                        = "email"                        // Email.
+	EntitlementMarketplaceServiceID       = "entitlement.marketplace"      // EntitlementMarketplace.
+	EsServiceID                           = "es"                           // Es.
+	EventsServiceID                       = "events"                       // Events.
+	FirehoseServiceID                     = "firehose"                     // Firehose.
+	FmsServiceID                          = "fms"                          // Fms.
+	GameliftServiceID                     = "gamelift"                     // Gamelift.
+	GlacierServiceID                      = "glacier"                      // Glacier.
+	GlueServiceID                         = "glue"                         // Glue.
+	GreengrassServiceID                   = "greengrass"                   // Greengrass.
+	GuarddutyServiceID                    = "guardduty"                    // Guardduty.
+	HealthServiceID                       = "health"                       // Health.
+	IamServiceID                          = "iam"                          // Iam.
+	ImportexportServiceID                 = "importexport"                 // Importexport.
+	InspectorServiceID                    = "inspector"                    // Inspector.
+	IotServiceID                          = "iot"                          // Iot.
+	IotanalyticsServiceID                 = "iotanalytics"                 // Iotanalytics.
+	KinesisServiceID                      = "kinesis"                      // Kinesis.
+	KinesisanalyticsServiceID             = "kinesisanalytics"             // Kinesisanalytics.
+	KinesisvideoServiceID                 = "kinesisvideo"                 // Kinesisvideo.
+	KmsServiceID                          = "kms"                          // Kms.
+	LambdaServiceID                       = "lambda"                       // Lambda.
+	LightsailServiceID                    = "lightsail"                    // Lightsail.
+	LogsServiceID                         = "logs"                         // Logs.
+	MachinelearningServiceID              = "machinelearning"              // Machinelearning.
+	MarketplacecommerceanalyticsServiceID = "marketplacecommerceanalytics" // Marketplacecommerceanalytics.
+	MediaconvertServiceID                 = "mediaconvert"                 // Mediaconvert.
+	MedialiveServiceID                    = "medialive"                    // Medialive.
+	MediapackageServiceID                 = "mediapackage"                 // Mediapackage.
+	MediastoreServiceID                   = "mediastore"                   // Mediastore.
+	MeteringMarketplaceServiceID          = "metering.marketplace"         // MeteringMarketplace.
+	MghServiceID                          = "mgh"                          // Mgh.
+	MobileanalyticsServiceID              = "mobileanalytics"              // Mobileanalytics.
+	ModelsLexServiceID                    = "models.lex"                   // ModelsLex.
+	MonitoringServiceID                   = "monitoring"                   // Monitoring.
+	MturkRequesterServiceID               = "mturk-requester"              // MturkRequester.
+	NeptuneServiceID                      = "neptune"                      // Neptune.
+	OpsworksServiceID                     = "opsworks"                     // Opsworks.
+	OpsworksCmServiceID                   = "opsworks-cm"                  // OpsworksCm.
+	OrganizationsServiceID                = "organizations"                // Organizations.
+	PinpointServiceID                     = "pinpoint"                     // Pinpoint.
+	PollyServiceID                        = "polly"                        // Polly.
+	RdsServiceID                          = "rds"                          // Rds.
+	RedshiftServiceID                     = "redshift"                     // Redshift.
+	RekognitionServiceID                  = "rekognition"                  // Rekognition.
+	ResourceGroupsServiceID               = "resource-groups"              // ResourceGroups.
+	Route53ServiceID                      = "route53"                      // Route53.
+	Route53domainsServiceID               = "route53domains"               // Route53domains.
+	RuntimeLexServiceID                   = "runtime.lex"                  // RuntimeLex.
+	RuntimeSagemakerServiceID             = "runtime.sagemaker"            // RuntimeSagemaker.
+	S3ServiceID                           = "s3"                           // S3.
+	S3ControlServiceID                    = "s3-control"                   // S3Control.
+	SagemakerServiceID                    = "api.sagemaker"                // Sagemaker.
+	SdbServiceID                          = "sdb"                          // Sdb.
+	SecretsmanagerServiceID               = "secretsmanager"               // Secretsmanager.
+	ServerlessrepoServiceID               = "serverlessrepo"               // Serverlessrepo.
+	ServicecatalogServiceID               = "servicecatalog"               // Servicecatalog.
+	ServicediscoveryServiceID             = "servicediscovery"             // Servicediscovery.
+	ShieldServiceID                       = "shield"                       // Shield.
+	SmsServiceID                          = "sms"                          // Sms.
+	SnowballServiceID                     = "snowball"                     // Snowball.
+	SnsServiceID                          = "sns"                          // Sns.
+	SqsServiceID                          = "sqs"                          // Sqs.
+	SsmServiceID                          = "ssm"                          // Ssm.
+	StatesServiceID                       = "states"                       // States.
+	StoragegatewayServiceID               = "storagegateway"               // Storagegateway.
+	StreamsDynamodbServiceID              = "streams.dynamodb"             // StreamsDynamodb.
+	StsServiceID                          = "sts"                          // Sts.
+	SupportServiceID                      = "support"                      // Support.
+	SwfServiceID                          = "swf"                          // Swf.
+	TaggingServiceID                      = "tagging"                      // Tagging.
+	TransferServiceID                     = "transfer"                     // Transfer.
+	TranslateServiceID                    = "translate"                    // Translate.
+	WafServiceID                          = "waf"                          // Waf.
+	WafRegionalServiceID                  = "waf-regional"                 // WafRegional.
+	WorkdocsServiceID                     = "workdocs"                     // Workdocs.
+	WorkmailServiceID                     = "workmail"                     // Workmail.
+	WorkspacesServiceID                   = "workspaces"                   // Workspaces.
+	XrayServiceID                         = "xray"                         // Xray.
+)
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/endpoints/doc.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/endpoints/doc.go
new file mode 100644
index 00000000..84316b92
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/endpoints/doc.go
@@ -0,0 +1,66 @@
+// Package endpoints provides the types and functionality for defining regions
+// and endpoints, as well as querying those definitions.
+//
+// The SDK's Regions and Endpoints metadata is code generated into the endpoints
+// package, and is accessible via the DefaultResolver function. This function
+// returns a endpoint Resolver will search the metadata and build an associated
+// endpoint if one is found. The default resolver will search all partitions
+// known by the SDK. e.g AWS Standard (aws), AWS China (aws-cn), and
+// AWS GovCloud (US) (aws-us-gov).
+// .
+//
+// Enumerating Regions and Endpoint Metadata
+//
+// Casting the Resolver returned by DefaultResolver to a EnumPartitions interface
+// will allow you to get access to the list of underlying Partitions with the
+// Partitions method. This is helpful if you want to limit the SDK's endpoint
+// resolving to a single partition, or enumerate regions, services, and endpoints
+// in the partition.
+//
+//     resolver := endpoints.DefaultResolver()
+//     partitions := resolver.(endpoints.EnumPartitions).Partitions()
+//
+//     for _, p := range partitions {
+//         fmt.Println("Regions for", p.ID())
+//         for id, _ := range p.Regions() {
+//             fmt.Println("*", id)
+//         }
+//
+//         fmt.Println("Services for", p.ID())
+//         for id, _ := range p.Services() {
+//             fmt.Println("*", id)
+//         }
+//     }
+//
+// Using Custom Endpoints
+//
+// The endpoints package also gives you the ability to use your own logic how
+// endpoints are resolved. This is a great way to define a custom endpoint
+// for select services, without passing that logic down through your code.
+//
+// If a type implements the Resolver interface it can be used to resolve
+// endpoints. To use this with the SDK's Session and Config set the value
+// of the type to the EndpointsResolver field of aws.Config when initializing
+// the session, or service client.
+//
+// In addition the ResolverFunc is a wrapper for a func matching the signature
+// of Resolver.EndpointFor, converting it to a type that satisfies the
+// Resolver interface.
+//
+//
+//     myCustomResolver := func(service, region string, optFns ...func(*endpoints.Options)) (endpoints.ResolvedEndpoint, error) {
+//         if service == endpoints.S3ServiceID {
+//             return endpoints.ResolvedEndpoint{
+//                 URL:           "s3.custom.endpoint.com",
+//                 SigningRegion: "custom-signing-region",
+//             }, nil
+//         }
+//
+//         return endpoints.DefaultResolver().EndpointFor(service, region, optFns...)
+//     }
+//
+//     sess := session.Must(session.NewSession(&aws.Config{
+//         Region:           aws.String("us-west-2"),
+//         EndpointResolver: endpoints.ResolverFunc(myCustomResolver),
+//     }))
+package endpoints
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/endpoints/endpoints.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/endpoints/endpoints.go
new file mode 100644
index 00000000..f82babf6
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/endpoints/endpoints.go
@@ -0,0 +1,449 @@
+package endpoints
+
+import (
+	"fmt"
+	"regexp"
+
+	"github.com/aws/aws-sdk-go/aws/awserr"
+)
+
+// Options provide the configuration needed to direct how the
+// endpoints will be resolved.
+type Options struct {
+	// DisableSSL forces the endpoint to be resolved as HTTP.
+	// instead of HTTPS if the service supports it.
+	DisableSSL bool
+
+	// Sets the resolver to resolve the endpoint as a dualstack endpoint
+	// for the service. If dualstack support for a service is not known and
+	// StrictMatching is not enabled a dualstack endpoint for the service will
+	// be returned. This endpoint may not be valid. If StrictMatching is
+	// enabled only services that are known to support dualstack will return
+	// dualstack endpoints.
+	UseDualStack bool
+
+	// Enables strict matching of services and regions resolved endpoints.
+	// If the partition doesn't enumerate the exact service and region an
+	// error will be returned. This option will prevent returning endpoints
+	// that look valid, but may not resolve to any real endpoint.
+	StrictMatching bool
+
+	// Enables resolving a service endpoint based on the region provided if the
+	// service does not exist. The service endpoint ID will be used as the service
+	// domain name prefix. By default the endpoint resolver requires the service
+	// to be known when resolving endpoints.
+	//
+	// If resolving an endpoint on the partition list the provided region will
+	// be used to determine which partition's domain name pattern to the service
+	// endpoint ID with. If both the service and region are unknown and resolving
+	// the endpoint on partition list an UnknownEndpointError error will be returned.
+	//
+	// If resolving and endpoint on a partition specific resolver that partition's
+	// domain name pattern will be used with the service endpoint ID. If both
+	// region and service do not exist when resolving an endpoint on a specific
+	// partition the partition's domain pattern will be used to combine the
+	// endpoint and region together.
+	//
+	// This option is ignored if StrictMatching is enabled.
+	ResolveUnknownService bool
+}
+
+// Set combines all of the option functions together.
+func (o *Options) Set(optFns ...func(*Options)) {
+	for _, fn := range optFns {
+		fn(o)
+	}
+}
+
+// DisableSSLOption sets the DisableSSL options. Can be used as a functional
+// option when resolving endpoints.
+func DisableSSLOption(o *Options) {
+	o.DisableSSL = true
+}
+
+// UseDualStackOption sets the UseDualStack option. Can be used as a functional
+// option when resolving endpoints.
+func UseDualStackOption(o *Options) {
+	o.UseDualStack = true
+}
+
+// StrictMatchingOption sets the StrictMatching option. Can be used as a functional
+// option when resolving endpoints.
+func StrictMatchingOption(o *Options) {
+	o.StrictMatching = true
+}
+
+// ResolveUnknownServiceOption sets the ResolveUnknownService option. Can be used
+// as a functional option when resolving endpoints.
+func ResolveUnknownServiceOption(o *Options) {
+	o.ResolveUnknownService = true
+}
+
+// A Resolver provides the interface for functionality to resolve endpoints.
+// The build in Partition and DefaultResolver return value satisfy this interface.
+type Resolver interface {
+	EndpointFor(service, region string, opts ...func(*Options)) (ResolvedEndpoint, error)
+}
+
+// ResolverFunc is a helper utility that wraps a function so it satisfies the
+// Resolver interface. This is useful when you want to add additional endpoint
+// resolving logic, or stub out specific endpoints with custom values.
+type ResolverFunc func(service, region string, opts ...func(*Options)) (ResolvedEndpoint, error)
+
+// EndpointFor wraps the ResolverFunc function to satisfy the Resolver interface.
+func (fn ResolverFunc) EndpointFor(service, region string, opts ...func(*Options)) (ResolvedEndpoint, error) {
+	return fn(service, region, opts...)
+}
+
+var schemeRE = regexp.MustCompile("^([^:]+)://")
+
+// AddScheme adds the HTTP or HTTPS schemes to a endpoint URL if there is no
+// scheme. If disableSSL is true HTTP will set HTTP instead of the default HTTPS.
+//
+// If disableSSL is set, it will only set the URL's scheme if the URL does not
+// contain a scheme.
+func AddScheme(endpoint string, disableSSL bool) string {
+	if !schemeRE.MatchString(endpoint) {
+		scheme := "https"
+		if disableSSL {
+			scheme = "http"
+		}
+		endpoint = fmt.Sprintf("%s://%s", scheme, endpoint)
+	}
+
+	return endpoint
+}
+
+// EnumPartitions a provides a way to retrieve the underlying partitions that
+// make up the SDK's default Resolver, or any resolver decoded from a model
+// file.
+//
+// Use this interface with DefaultResolver and DecodeModels to get the list of
+// Partitions.
+type EnumPartitions interface {
+	Partitions() []Partition
+}
+
+// RegionsForService returns a map of regions for the partition and service.
+// If either the partition or service does not exist false will be returned
+// as the second parameter.
+//
+// This example shows how  to get the regions for DynamoDB in the AWS partition.
+//    rs, exists := endpoints.RegionsForService(endpoints.DefaultPartitions(), endpoints.AwsPartitionID, endpoints.DynamodbServiceID)
+//
+// This is equivalent to using the partition directly.
+//    rs := endpoints.AwsPartition().Services()[endpoints.DynamodbServiceID].Regions()
+func RegionsForService(ps []Partition, partitionID, serviceID string) (map[string]Region, bool) {
+	for _, p := range ps {
+		if p.ID() != partitionID {
+			continue
+		}
+		if _, ok := p.p.Services[serviceID]; !ok {
+			break
+		}
+
+		s := Service{
+			id: serviceID,
+			p:  p.p,
+		}
+		return s.Regions(), true
+	}
+
+	return map[string]Region{}, false
+}
+
+// PartitionForRegion returns the first partition which includes the region
+// passed in. This includes both known regions and regions which match
+// a pattern supported by the partition which may include regions that are
+// not explicitly known by the partition. Use the Regions method of the
+// returned Partition if explicit support is needed.
+func PartitionForRegion(ps []Partition, regionID string) (Partition, bool) {
+	for _, p := range ps {
+		if _, ok := p.p.Regions[regionID]; ok || p.p.RegionRegex.MatchString(regionID) {
+			return p, true
+		}
+	}
+
+	return Partition{}, false
+}
+
+// A Partition provides the ability to enumerate the partition's regions
+// and services.
+type Partition struct {
+	id string
+	p  *partition
+}
+
+// ID returns the identifier of the partition.
+func (p Partition) ID() string { return p.id }
+
+// EndpointFor attempts to resolve the endpoint based on service and region.
+// See Options for information on configuring how the endpoint is resolved.
+//
+// If the service cannot be found in the metadata the UnknownServiceError
+// error will be returned. This validation will occur regardless if
+// StrictMatching is enabled. To enable resolving unknown services set the
+// "ResolveUnknownService" option to true. When StrictMatching is disabled
+// this option allows the partition resolver to resolve a endpoint based on
+// the service endpoint ID provided.
+//
+// When resolving endpoints you can choose to enable StrictMatching. This will
+// require the provided service and region to be known by the partition.
+// If the endpoint cannot be strictly resolved an error will be returned. This
+// mode is useful to ensure the endpoint resolved is valid. Without
+// StrictMatching enabled the endpoint returned my look valid but may not work.
+// StrictMatching requires the SDK to be updated if you want to take advantage
+// of new regions and services expansions.
+//
+// Errors that can be returned.
+//   * UnknownServiceError
+//   * UnknownEndpointError
+func (p Partition) EndpointFor(service, region string, opts ...func(*Options)) (ResolvedEndpoint, error) {
+	return p.p.EndpointFor(service, region, opts...)
+}
+
+// Regions returns a map of Regions indexed by their ID. This is useful for
+// enumerating over the regions in a partition.
+func (p Partition) Regions() map[string]Region {
+	rs := map[string]Region{}
+	for id, r := range p.p.Regions {
+		rs[id] = Region{
+			id:   id,
+			desc: r.Description,
+			p:    p.p,
+		}
+	}
+
+	return rs
+}
+
+// Services returns a map of Service indexed by their ID. This is useful for
+// enumerating over the services in a partition.
+func (p Partition) Services() map[string]Service {
+	ss := map[string]Service{}
+	for id := range p.p.Services {
+		ss[id] = Service{
+			id: id,
+			p:  p.p,
+		}
+	}
+
+	return ss
+}
+
+// A Region provides information about a region, and ability to resolve an
+// endpoint from the context of a region, given a service.
+type Region struct {
+	id, desc string
+	p        *partition
+}
+
+// ID returns the region's identifier.
+func (r Region) ID() string { return r.id }
+
+// Description returns the region's description. The region description
+// is free text, it can be empty, and it may change between SDK releases.
+func (r Region) Description() string { return r.desc }
+
+// ResolveEndpoint resolves an endpoint from the context of the region given
+// a service. See Partition.EndpointFor for usage and errors that can be returned.
+func (r Region) ResolveEndpoint(service string, opts ...func(*Options)) (ResolvedEndpoint, error) {
+	return r.p.EndpointFor(service, r.id, opts...)
+}
+
+// Services returns a list of all services that are known to be in this region.
+func (r Region) Services() map[string]Service {
+	ss := map[string]Service{}
+	for id, s := range r.p.Services {
+		if _, ok := s.Endpoints[r.id]; ok {
+			ss[id] = Service{
+				id: id,
+				p:  r.p,
+			}
+		}
+	}
+
+	return ss
+}
+
+// A Service provides information about a service, and ability to resolve an
+// endpoint from the context of a service, given a region.
+type Service struct {
+	id string
+	p  *partition
+}
+
+// ID returns the identifier for the service.
+func (s Service) ID() string { return s.id }
+
+// ResolveEndpoint resolves an endpoint from the context of a service given
+// a region. See Partition.EndpointFor for usage and errors that can be returned.
+func (s Service) ResolveEndpoint(region string, opts ...func(*Options)) (ResolvedEndpoint, error) {
+	return s.p.EndpointFor(s.id, region, opts...)
+}
+
+// Regions returns a map of Regions that the service is present in.
+//
+// A region is the AWS region the service exists in. Whereas a Endpoint is
+// an URL that can be resolved to a instance of a service.
+func (s Service) Regions() map[string]Region {
+	rs := map[string]Region{}
+	for id := range s.p.Services[s.id].Endpoints {
+		if r, ok := s.p.Regions[id]; ok {
+			rs[id] = Region{
+				id:   id,
+				desc: r.Description,
+				p:    s.p,
+			}
+		}
+	}
+
+	return rs
+}
+
+// Endpoints returns a map of Endpoints indexed by their ID for all known
+// endpoints for a service.
+//
+// A region is the AWS region the service exists in. Whereas a Endpoint is
+// an URL that can be resolved to a instance of a service.
+func (s Service) Endpoints() map[string]Endpoint {
+	es := map[string]Endpoint{}
+	for id := range s.p.Services[s.id].Endpoints {
+		es[id] = Endpoint{
+			id:        id,
+			serviceID: s.id,
+			p:         s.p,
+		}
+	}
+
+	return es
+}
+
+// A Endpoint provides information about endpoints, and provides the ability
+// to resolve that endpoint for the service, and the region the endpoint
+// represents.
+type Endpoint struct {
+	id        string
+	serviceID string
+	p         *partition
+}
+
+// ID returns the identifier for an endpoint.
+func (e Endpoint) ID() string { return e.id }
+
+// ServiceID returns the identifier the endpoint belongs to.
+func (e Endpoint) ServiceID() string { return e.serviceID }
+
+// ResolveEndpoint resolves an endpoint from the context of a service and
+// region the endpoint represents. See Partition.EndpointFor for usage and
+// errors that can be returned.
+func (e Endpoint) ResolveEndpoint(opts ...func(*Options)) (ResolvedEndpoint, error) {
+	return e.p.EndpointFor(e.serviceID, e.id, opts...)
+}
+
+// A ResolvedEndpoint is an endpoint that has been resolved based on a partition
+// service, and region.
+type ResolvedEndpoint struct {
+	// The endpoint URL
+	URL string
+
+	// The region that should be used for signing requests.
+	SigningRegion string
+
+	// The service name that should be used for signing requests.
+	SigningName string
+
+	// States that the signing name for this endpoint was derived from metadata
+	// passed in, but was not explicitly modeled.
+	SigningNameDerived bool
+
+	// The signing method that should be used for signing requests.
+	SigningMethod string
+}
+
+// So that the Error interface type can be included as an anonymous field
+// in the requestError struct and not conflict with the error.Error() method.
+type awsError awserr.Error
+
+// A EndpointNotFoundError is returned when in StrictMatching mode, and the
+// endpoint for the service and region cannot be found in any of the partitions.
+type EndpointNotFoundError struct {
+	awsError
+	Partition string
+	Service   string
+	Region    string
+}
+
+// A UnknownServiceError is returned when the service does not resolve to an
+// endpoint. Includes a list of all known services for the partition. Returned
+// when a partition does not support the service.
+type UnknownServiceError struct {
+	awsError
+	Partition string
+	Service   string
+	Known     []string
+}
+
+// NewUnknownServiceError builds and returns UnknownServiceError.
+func NewUnknownServiceError(p, s string, known []string) UnknownServiceError {
+	return UnknownServiceError{
+		awsError: awserr.New("UnknownServiceError",
+			"could not resolve endpoint for unknown service", nil),
+		Partition: p,
+		Service:   s,
+		Known:     known,
+	}
+}
+
+// String returns the string representation of the error.
+func (e UnknownServiceError) Error() string {
+	extra := fmt.Sprintf("partition: %q, service: %q",
+		e.Partition, e.Service)
+	if len(e.Known) > 0 {
+		extra += fmt.Sprintf(", known: %v", e.Known)
+	}
+	return awserr.SprintError(e.Code(), e.Message(), extra, e.OrigErr())
+}
+
+// String returns the string representation of the error.
+func (e UnknownServiceError) String() string {
+	return e.Error()
+}
+
+// A UnknownEndpointError is returned when in StrictMatching mode and the
+// service is valid, but the region does not resolve to an endpoint. Includes
+// a list of all known endpoints for the service.
+type UnknownEndpointError struct {
+	awsError
+	Partition string
+	Service   string
+	Region    string
+	Known     []string
+}
+
+// NewUnknownEndpointError builds and returns UnknownEndpointError.
+func NewUnknownEndpointError(p, s, r string, known []string) UnknownEndpointError {
+	return UnknownEndpointError{
+		awsError: awserr.New("UnknownEndpointError",
+			"could not resolve endpoint", nil),
+		Partition: p,
+		Service:   s,
+		Region:    r,
+		Known:     known,
+	}
+}
+
+// String returns the string representation of the error.
+func (e UnknownEndpointError) Error() string {
+	extra := fmt.Sprintf("partition: %q, service: %q, region: %q",
+		e.Partition, e.Service, e.Region)
+	if len(e.Known) > 0 {
+		extra += fmt.Sprintf(", known: %v", e.Known)
+	}
+	return awserr.SprintError(e.Code(), e.Message(), extra, e.OrigErr())
+}
+
+// String returns the string representation of the error.
+func (e UnknownEndpointError) String() string {
+	return e.Error()
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/endpoints/v3model.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/endpoints/v3model.go
new file mode 100644
index 00000000..ff6f76db
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/endpoints/v3model.go
@@ -0,0 +1,307 @@
+package endpoints
+
+import (
+	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+type partitions []partition
+
+func (ps partitions) EndpointFor(service, region string, opts ...func(*Options)) (ResolvedEndpoint, error) {
+	var opt Options
+	opt.Set(opts...)
+
+	for i := 0; i < len(ps); i++ {
+		if !ps[i].canResolveEndpoint(service, region, opt.StrictMatching) {
+			continue
+		}
+
+		return ps[i].EndpointFor(service, region, opts...)
+	}
+
+	// If loose matching fallback to first partition format to use
+	// when resolving the endpoint.
+	if !opt.StrictMatching && len(ps) > 0 {
+		return ps[0].EndpointFor(service, region, opts...)
+	}
+
+	return ResolvedEndpoint{}, NewUnknownEndpointError("all partitions", service, region, []string{})
+}
+
+// Partitions satisfies the EnumPartitions interface and returns a list
+// of Partitions representing each partition represented in the SDK's
+// endpoints model.
+func (ps partitions) Partitions() []Partition {
+	parts := make([]Partition, 0, len(ps))
+	for i := 0; i < len(ps); i++ {
+		parts = append(parts, ps[i].Partition())
+	}
+
+	return parts
+}
+
+type partition struct {
+	ID          string      `json:"partition"`
+	Name        string      `json:"partitionName"`
+	DNSSuffix   string      `json:"dnsSuffix"`
+	RegionRegex regionRegex `json:"regionRegex"`
+	Defaults    endpoint    `json:"defaults"`
+	Regions     regions     `json:"regions"`
+	Services    services    `json:"services"`
+}
+
+func (p partition) Partition() Partition {
+	return Partition{
+		id: p.ID,
+		p:  &p,
+	}
+}
+
+func (p partition) canResolveEndpoint(service, region string, strictMatch bool) bool {
+	s, hasService := p.Services[service]
+	_, hasEndpoint := s.Endpoints[region]
+
+	if hasEndpoint && hasService {
+		return true
+	}
+
+	if strictMatch {
+		return false
+	}
+
+	return p.RegionRegex.MatchString(region)
+}
+
+func (p partition) EndpointFor(service, region string, opts ...func(*Options)) (resolved ResolvedEndpoint, err error) {
+	var opt Options
+	opt.Set(opts...)
+
+	s, hasService := p.Services[service]
+	if !(hasService || opt.ResolveUnknownService) {
+		// Only return error if the resolver will not fallback to creating
+		// endpoint based on service endpoint ID passed in.
+		return resolved, NewUnknownServiceError(p.ID, service, serviceList(p.Services))
+	}
+
+	e, hasEndpoint := s.endpointForRegion(region)
+	if !hasEndpoint && opt.StrictMatching {
+		return resolved, NewUnknownEndpointError(p.ID, service, region, endpointList(s.Endpoints))
+	}
+
+	defs := []endpoint{p.Defaults, s.Defaults}
+	return e.resolve(service, region, p.DNSSuffix, defs, opt), nil
+}
+
+func serviceList(ss services) []string {
+	list := make([]string, 0, len(ss))
+	for k := range ss {
+		list = append(list, k)
+	}
+	return list
+}
+func endpointList(es endpoints) []string {
+	list := make([]string, 0, len(es))
+	for k := range es {
+		list = append(list, k)
+	}
+	return list
+}
+
+type regionRegex struct {
+	*regexp.Regexp
+}
+
+func (rr *regionRegex) UnmarshalJSON(b []byte) (err error) {
+	// Strip leading and trailing quotes
+	regex, err := strconv.Unquote(string(b))
+	if err != nil {
+		return fmt.Errorf("unable to strip quotes from regex, %v", err)
+	}
+
+	rr.Regexp, err = regexp.Compile(regex)
+	if err != nil {
+		return fmt.Errorf("unable to unmarshal region regex, %v", err)
+	}
+	return nil
+}
+
+type regions map[string]region
+
+type region struct {
+	Description string `json:"description"`
+}
+
+type services map[string]service
+
+type service struct {
+	PartitionEndpoint string    `json:"partitionEndpoint"`
+	IsRegionalized    boxedBool `json:"isRegionalized,omitempty"`
+	Defaults          endpoint  `json:"defaults"`
+	Endpoints         endpoints `json:"endpoints"`
+}
+
+func (s *service) endpointForRegion(region string) (endpoint, bool) {
+	if s.IsRegionalized == boxedFalse {
+		return s.Endpoints[s.PartitionEndpoint], region == s.PartitionEndpoint
+	}
+
+	if e, ok := s.Endpoints[region]; ok {
+		return e, true
+	}
+
+	// Unable to find any matching endpoint, return
+	// blank that will be used for generic endpoint creation.
+	return endpoint{}, false
+}
+
+type endpoints map[string]endpoint
+
+type endpoint struct {
+	Hostname        string          `json:"hostname"`
+	Protocols       []string        `json:"protocols"`
+	CredentialScope credentialScope `json:"credentialScope"`
+
+	// Custom fields not modeled
+	HasDualStack      boxedBool `json:"-"`
+	DualStackHostname string    `json:"-"`
+
+	// Signature Version not used
+	SignatureVersions []string `json:"signatureVersions"`
+
+	// SSLCommonName not used.
+	SSLCommonName string `json:"sslCommonName"`
+}
+
+const (
+	defaultProtocol = "https"
+	defaultSigner   = "v4"
+)
+
+var (
+	protocolPriority = []string{"https", "http"}
+	signerPriority   = []string{"v4", "v2"}
+)
+
+func getByPriority(s []string, p []string, def string) string {
+	if len(s) == 0 {
+		return def
+	}
+
+	for i := 0; i < len(p); i++ {
+		for j := 0; j < len(s); j++ {
+			if s[j] == p[i] {
+				return s[j]
+			}
+		}
+	}
+
+	return s[0]
+}
+
+func (e endpoint) resolve(service, region, dnsSuffix string, defs []endpoint, opts Options) ResolvedEndpoint {
+	var merged endpoint
+	for _, def := range defs {
+		merged.mergeIn(def)
+	}
+	merged.mergeIn(e)
+	e = merged
+
+	hostname := e.Hostname
+
+	// Offset the hostname for dualstack if enabled
+	if opts.UseDualStack && e.HasDualStack == boxedTrue {
+		hostname = e.DualStackHostname
+	}
+
+	u := strings.Replace(hostname, "{service}", service, 1)
+	u = strings.Replace(u, "{region}", region, 1)
+	u = strings.Replace(u, "{dnsSuffix}", dnsSuffix, 1)
+
+	scheme := getEndpointScheme(e.Protocols, opts.DisableSSL)
+	u = fmt.Sprintf("%s://%s", scheme, u)
+
+	signingRegion := e.CredentialScope.Region
+	if len(signingRegion) == 0 {
+		signingRegion = region
+	}
+
+	signingName := e.CredentialScope.Service
+	var signingNameDerived bool
+	if len(signingName) == 0 {
+		signingName = service
+		signingNameDerived = true
+	}
+
+	return ResolvedEndpoint{
+		URL:                u,
+		SigningRegion:      signingRegion,
+		SigningName:        signingName,
+		SigningNameDerived: signingNameDerived,
+		SigningMethod:      getByPriority(e.SignatureVersions, signerPriority, defaultSigner),
+	}
+}
+
+func getEndpointScheme(protocols []string, disableSSL bool) string {
+	if disableSSL {
+		return "http"
+	}
+
+	return getByPriority(protocols, protocolPriority, defaultProtocol)
+}
+
+func (e *endpoint) mergeIn(other endpoint) {
+	if len(other.Hostname) > 0 {
+		e.Hostname = other.Hostname
+	}
+	if len(other.Protocols) > 0 {
+		e.Protocols = other.Protocols
+	}
+	if len(other.SignatureVersions) > 0 {
+		e.SignatureVersions = other.SignatureVersions
+	}
+	if len(other.CredentialScope.Region) > 0 {
+		e.CredentialScope.Region = other.CredentialScope.Region
+	}
+	if len(other.CredentialScope.Service) > 0 {
+		e.CredentialScope.Service = other.CredentialScope.Service
+	}
+	if len(other.SSLCommonName) > 0 {
+		e.SSLCommonName = other.SSLCommonName
+	}
+	if other.HasDualStack != boxedBoolUnset {
+		e.HasDualStack = other.HasDualStack
+	}
+	if len(other.DualStackHostname) > 0 {
+		e.DualStackHostname = other.DualStackHostname
+	}
+}
+
+type credentialScope struct {
+	Region  string `json:"region"`
+	Service string `json:"service"`
+}
+
+type boxedBool int
+
+func (b *boxedBool) UnmarshalJSON(buf []byte) error {
+	v, err := strconv.ParseBool(string(buf))
+	if err != nil {
+		return err
+	}
+
+	if v {
+		*b = boxedTrue
+	} else {
+		*b = boxedFalse
+	}
+
+	return nil
+}
+
+const (
+	boxedBoolUnset boxedBool = iota
+	boxedFalse
+	boxedTrue
+)
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/endpoints/v3model_codegen.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/endpoints/v3model_codegen.go
new file mode 100644
index 00000000..0fdfcc56
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/endpoints/v3model_codegen.go
@@ -0,0 +1,351 @@
+// +build codegen
+
+package endpoints
+
+import (
+	"fmt"
+	"io"
+	"reflect"
+	"strings"
+	"text/template"
+	"unicode"
+)
+
+// A CodeGenOptions are the options for code generating the endpoints into
+// Go code from the endpoints model definition.
+type CodeGenOptions struct {
+	// Options for how the model will be decoded.
+	DecodeModelOptions DecodeModelOptions
+
+	// Disables code generation of the service endpoint prefix IDs defined in
+	// the model.
+	DisableGenerateServiceIDs bool
+}
+
+// Set combines all of the option functions together
+func (d *CodeGenOptions) Set(optFns ...func(*CodeGenOptions)) {
+	for _, fn := range optFns {
+		fn(d)
+	}
+}
+
+// CodeGenModel given a endpoints model file will decode it and attempt to
+// generate Go code from the model definition. Error will be returned if
+// the code is unable to be generated, or decoded.
+func CodeGenModel(modelFile io.Reader, outFile io.Writer, optFns ...func(*CodeGenOptions)) error {
+	var opts CodeGenOptions
+	opts.Set(optFns...)
+
+	resolver, err := DecodeModel(modelFile, func(d *DecodeModelOptions) {
+		*d = opts.DecodeModelOptions
+	})
+	if err != nil {
+		return err
+	}
+
+	v := struct {
+		Resolver
+		CodeGenOptions
+	}{
+		Resolver:       resolver,
+		CodeGenOptions: opts,
+	}
+
+	tmpl := template.Must(template.New("tmpl").Funcs(funcMap).Parse(v3Tmpl))
+	if err := tmpl.ExecuteTemplate(outFile, "defaults", v); err != nil {
+		return fmt.Errorf("failed to execute template, %v", err)
+	}
+
+	return nil
+}
+
+func toSymbol(v string) string {
+	out := []rune{}
+	for _, c := range strings.Title(v) {
+		if !(unicode.IsNumber(c) || unicode.IsLetter(c)) {
+			continue
+		}
+
+		out = append(out, c)
+	}
+
+	return string(out)
+}
+
+func quoteString(v string) string {
+	return fmt.Sprintf("%q", v)
+}
+
+func regionConstName(p, r string) string {
+	return toSymbol(p) + toSymbol(r)
+}
+
+func partitionGetter(id string) string {
+	return fmt.Sprintf("%sPartition", toSymbol(id))
+}
+
+func partitionVarName(id string) string {
+	return fmt.Sprintf("%sPartition", strings.ToLower(toSymbol(id)))
+}
+
+func listPartitionNames(ps partitions) string {
+	names := []string{}
+	switch len(ps) {
+	case 1:
+		return ps[0].Name
+	case 2:
+		return fmt.Sprintf("%s and %s", ps[0].Name, ps[1].Name)
+	default:
+		for i, p := range ps {
+			if i == len(ps)-1 {
+				names = append(names, "and "+p.Name)
+			} else {
+				names = append(names, p.Name)
+			}
+		}
+		return strings.Join(names, ", ")
+	}
+}
+
+func boxedBoolIfSet(msg string, v boxedBool) string {
+	switch v {
+	case boxedTrue:
+		return fmt.Sprintf(msg, "boxedTrue")
+	case boxedFalse:
+		return fmt.Sprintf(msg, "boxedFalse")
+	default:
+		return ""
+	}
+}
+
+func stringIfSet(msg, v string) string {
+	if len(v) == 0 {
+		return ""
+	}
+
+	return fmt.Sprintf(msg, v)
+}
+
+func stringSliceIfSet(msg string, vs []string) string {
+	if len(vs) == 0 {
+		return ""
+	}
+
+	names := []string{}
+	for _, v := range vs {
+		names = append(names, `"`+v+`"`)
+	}
+
+	return fmt.Sprintf(msg, strings.Join(names, ","))
+}
+
+func endpointIsSet(v endpoint) bool {
+	return !reflect.DeepEqual(v, endpoint{})
+}
+
+func serviceSet(ps partitions) map[string]struct{} {
+	set := map[string]struct{}{}
+	for _, p := range ps {
+		for id := range p.Services {
+			set[id] = struct{}{}
+		}
+	}
+
+	return set
+}
+
+var funcMap = template.FuncMap{
+	"ToSymbol":           toSymbol,
+	"QuoteString":        quoteString,
+	"RegionConst":        regionConstName,
+	"PartitionGetter":    partitionGetter,
+	"PartitionVarName":   partitionVarName,
+	"ListPartitionNames": listPartitionNames,
+	"BoxedBoolIfSet":     boxedBoolIfSet,
+	"StringIfSet":        stringIfSet,
+	"StringSliceIfSet":   stringSliceIfSet,
+	"EndpointIsSet":      endpointIsSet,
+	"ServicesSet":        serviceSet,
+}
+
+const v3Tmpl = `
+{{ define "defaults" -}}
+// Code generated by aws/endpoints/v3model_codegen.go. DO NOT EDIT.
+
+package endpoints
+
+import (
+	"regexp"
+)
+
+	{{ template "partition consts" $.Resolver }}
+
+	{{ range $_, $partition := $.Resolver }}
+		{{ template "partition region consts" $partition }}
+	{{ end }}
+
+	{{ if not $.DisableGenerateServiceIDs -}}
+	{{ template "service consts" $.Resolver }}
+	{{- end }}
+	
+	{{ template "endpoint resolvers" $.Resolver }}
+{{- end }}
+
+{{ define "partition consts" }}
+	// Partition identifiers
+	const (
+		{{ range $_, $p := . -}}
+			{{ ToSymbol $p.ID }}PartitionID = {{ QuoteString $p.ID }} // {{ $p.Name }} partition.
+		{{ end -}}
+	)
+{{- end }}
+
+{{ define "partition region consts" }}
+	// {{ .Name }} partition's regions.
+	const (
+		{{ range $id, $region := .Regions -}}
+			{{ ToSymbol $id }}RegionID = {{ QuoteString $id }} // {{ $region.Description }}.
+		{{ end -}}
+	)
+{{- end }}
+
+{{ define "service consts" }}
+	// Service identifiers
+	const (
+		{{ $serviceSet := ServicesSet . -}}
+		{{ range $id, $_ := $serviceSet -}}
+			{{ ToSymbol $id }}ServiceID = {{ QuoteString $id }} // {{ ToSymbol $id }}.
+		{{ end -}}
+	)
+{{- end }}
+
+{{ define "endpoint resolvers" }}
+	// DefaultResolver returns an Endpoint resolver that will be able
+	// to resolve endpoints for: {{ ListPartitionNames . }}.
+	//
+	// Use DefaultPartitions() to get the list of the default partitions.
+	func DefaultResolver() Resolver {
+		return defaultPartitions
+	}
+
+	// DefaultPartitions returns a list of the partitions the SDK is bundled
+	// with. The available partitions are: {{ ListPartitionNames . }}.
+	//
+	//    partitions := endpoints.DefaultPartitions
+	//    for _, p := range partitions {
+	//        // ... inspect partitions
+	//    }
+	func DefaultPartitions() []Partition {
+		return defaultPartitions.Partitions()
+	}
+
+	var defaultPartitions = partitions{
+		{{ range $_, $partition := . -}}
+			{{ PartitionVarName $partition.ID }},
+		{{ end }}
+	}
+	
+	{{ range $_, $partition := . -}}
+		{{ $name := PartitionGetter $partition.ID -}}
+		// {{ $name }} returns the Resolver for {{ $partition.Name }}.
+		func {{ $name }}() Partition {
+			return  {{ PartitionVarName $partition.ID }}.Partition()
+		}
+		var {{ PartitionVarName $partition.ID }} = {{ template "gocode Partition" $partition }}
+	{{ end }}
+{{ end }}
+
+{{ define "default partitions" }}
+	func DefaultPartitions() []Partition {
+		return []partition{
+			{{ range $_, $partition := . -}}
+			// {{ ToSymbol $partition.ID}}Partition(),
+			{{ end }}
+		}
+	}
+{{ end }}
+
+{{ define "gocode Partition" -}}
+partition{
+	{{ StringIfSet "ID: %q,\n" .ID -}}
+	{{ StringIfSet "Name: %q,\n" .Name -}}
+	{{ StringIfSet "DNSSuffix: %q,\n" .DNSSuffix -}}
+	RegionRegex: {{ template "gocode RegionRegex" .RegionRegex }},
+	{{ if EndpointIsSet .Defaults -}}
+		Defaults: {{ template "gocode Endpoint" .Defaults }},
+	{{- end }}
+	Regions:  {{ template "gocode Regions" .Regions }},
+	Services: {{ template "gocode Services" .Services }},
+}
+{{- end }}
+
+{{ define "gocode RegionRegex" -}}
+regionRegex{
+	Regexp: func() *regexp.Regexp{
+		reg, _ := regexp.Compile({{ QuoteString .Regexp.String }})
+		return reg
+	}(),
+}
+{{- end }}
+
+{{ define "gocode Regions" -}}
+regions{
+	{{ range $id, $region := . -}}
+		"{{ $id }}": {{ template "gocode Region" $region }},
+	{{ end -}}
+}
+{{- end }}
+
+{{ define "gocode Region" -}}
+region{
+	{{ StringIfSet "Description: %q,\n" .Description -}}
+}
+{{- end }}
+
+{{ define "gocode Services" -}}
+services{
+	{{ range $id, $service := . -}}
+	"{{ $id }}": {{ template "gocode Service" $service }},
+	{{ end }}
+}
+{{- end }}
+
+{{ define "gocode Service" -}}
+service{
+	{{ StringIfSet "PartitionEndpoint: %q,\n" .PartitionEndpoint -}}
+	{{ BoxedBoolIfSet "IsRegionalized: %s,\n" .IsRegionalized -}}
+	{{ if EndpointIsSet .Defaults -}}
+		Defaults: {{ template "gocode Endpoint" .Defaults -}},
+	{{- end }}
+	{{ if .Endpoints -}}
+		Endpoints: {{ template "gocode Endpoints" .Endpoints }},
+	{{- end }}
+}
+{{- end }}
+
+{{ define "gocode Endpoints" -}}
+endpoints{
+	{{ range $id, $endpoint := . -}}
+	"{{ $id }}": {{ template "gocode Endpoint" $endpoint }},
+	{{ end }}
+}
+{{- end }}
+
+{{ define "gocode Endpoint" -}}
+endpoint{
+	{{ StringIfSet "Hostname: %q,\n" .Hostname -}}
+	{{ StringIfSet "SSLCommonName: %q,\n" .SSLCommonName -}}
+	{{ StringSliceIfSet "Protocols: []string{%s},\n" .Protocols -}}
+	{{ StringSliceIfSet "SignatureVersions: []string{%s},\n" .SignatureVersions -}}
+	{{ if or .CredentialScope.Region .CredentialScope.Service -}}
+	CredentialScope: credentialScope{
+		{{ StringIfSet "Region: %q,\n" .CredentialScope.Region -}}
+		{{ StringIfSet "Service: %q,\n" .CredentialScope.Service -}}
+	},
+	{{- end }}
+	{{ BoxedBoolIfSet "HasDualStack: %s,\n" .HasDualStack -}}
+	{{ StringIfSet "DualStackHostname: %q,\n" .DualStackHostname -}}
+
+}
+{{- end }}
+`
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/errors.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/errors.go
new file mode 100644
index 00000000..fa06f7a8
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/errors.go
@@ -0,0 +1,13 @@
+package aws
+
+import "github.com/aws/aws-sdk-go/aws/awserr"
+
+var (
+	// ErrMissingRegion is an error that is returned if region configuration is
+	// not found.
+	ErrMissingRegion = awserr.New("MissingRegion", "could not find region configuration", nil)
+
+	// ErrMissingEndpoint is an error that is returned if an endpoint cannot be
+	// resolved for a service.
+	ErrMissingEndpoint = awserr.New("MissingEndpoint", "'Endpoint' configuration is required for this service", nil)
+)
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/jsonvalue.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/jsonvalue.go
new file mode 100644
index 00000000..91a6f277
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/jsonvalue.go
@@ -0,0 +1,12 @@
+package aws
+
+// JSONValue is a representation of a grab bag type that will be marshaled
+// into a json string. This type can be used just like any other map.
+//
+//	Example:
+//
+//	values := aws.JSONValue{
+//		"Foo": "Bar",
+//	}
+//	values["Baz"] = "Qux"
+type JSONValue map[string]interface{}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/logger.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/logger.go
new file mode 100644
index 00000000..6ed15b2e
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/logger.go
@@ -0,0 +1,118 @@
+package aws
+
+import (
+	"log"
+	"os"
+)
+
+// A LogLevelType defines the level logging should be performed at. Used to instruct
+// the SDK which statements should be logged.
+type LogLevelType uint
+
+// LogLevel returns the pointer to a LogLevel. Should be used to workaround
+// not being able to take the address of a non-composite literal.
+func LogLevel(l LogLevelType) *LogLevelType {
+	return &l
+}
+
+// Value returns the LogLevel value or the default value LogOff if the LogLevel
+// is nil. Safe to use on nil value LogLevelTypes.
+func (l *LogLevelType) Value() LogLevelType {
+	if l != nil {
+		return *l
+	}
+	return LogOff
+}
+
+// Matches returns true if the v LogLevel is enabled by this LogLevel. Should be
+// used with logging sub levels. Is safe to use on nil value LogLevelTypes. If
+// LogLevel is nil, will default to LogOff comparison.
+func (l *LogLevelType) Matches(v LogLevelType) bool {
+	c := l.Value()
+	return c&v == v
+}
+
+// AtLeast returns true if this LogLevel is at least high enough to satisfies v.
+// Is safe to use on nil value LogLevelTypes. If LogLevel is nil, will default
+// to LogOff comparison.
+func (l *LogLevelType) AtLeast(v LogLevelType) bool {
+	c := l.Value()
+	return c >= v
+}
+
+const (
+	// LogOff states that no logging should be performed by the SDK. This is the
+	// default state of the SDK, and should be use to disable all logging.
+	LogOff LogLevelType = iota * 0x1000
+
+	// LogDebug state that debug output should be logged by the SDK. This should
+	// be used to inspect request made and responses received.
+	LogDebug
+)
+
+// Debug Logging Sub Levels
+const (
+	// LogDebugWithSigning states that the SDK should log request signing and
+	// presigning events. This should be used to log the signing details of
+	// requests for debugging. Will also enable LogDebug.
+	LogDebugWithSigning LogLevelType = LogDebug | (1 << iota)
+
+	// LogDebugWithHTTPBody states the SDK should log HTTP request and response
+	// HTTP bodys in addition to the headers and path. This should be used to
+	// see the body content of requests and responses made while using the SDK
+	// Will also enable LogDebug.
+	LogDebugWithHTTPBody
+
+	// LogDebugWithRequestRetries states the SDK should log when service requests will
+	// be retried. This should be used to log when you want to log when service
+	// requests are being retried. Will also enable LogDebug.
+	LogDebugWithRequestRetries
+
+	// LogDebugWithRequestErrors states the SDK should log when service requests fail
+	// to build, send, validate, or unmarshal.
+	LogDebugWithRequestErrors
+
+	// LogDebugWithEventStreamBody states the SDK should log EventStream
+	// request and response bodys. This should be used to log the EventStream
+	// wire unmarshaled message content of requests and responses made while
+	// using the SDK Will also enable LogDebug.
+	LogDebugWithEventStreamBody
+)
+
+// A Logger is a minimalistic interface for the SDK to log messages to. Should
+// be used to provide custom logging writers for the SDK to use.
+type Logger interface {
+	Log(...interface{})
+}
+
+// A LoggerFunc is a convenience type to convert a function taking a variadic
+// list of arguments and wrap it so the Logger interface can be used.
+//
+// Example:
+//     s3.New(sess, &aws.Config{Logger: aws.LoggerFunc(func(args ...interface{}) {
+//         fmt.Fprintln(os.Stdout, args...)
+//     })})
+type LoggerFunc func(...interface{})
+
+// Log calls the wrapped function with the arguments provided
+func (f LoggerFunc) Log(args ...interface{}) {
+	f(args...)
+}
+
+// NewDefaultLogger returns a Logger which will write log messages to stdout, and
+// use same formatting runes as the stdlib log.Logger
+func NewDefaultLogger() Logger {
+	return &defaultLogger{
+		logger: log.New(os.Stdout, "", log.LstdFlags),
+	}
+}
+
+// A defaultLogger provides a minimalistic logger satisfying the Logger interface.
+type defaultLogger struct {
+	logger *log.Logger
+}
+
+// Log logs the parameters to the stdlib logger. See log.Println.
+func (l defaultLogger) Log(args ...interface{}) {
+	l.logger.Println(args...)
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/connection_reset_error.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/connection_reset_error.go
new file mode 100644
index 00000000..271da432
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/connection_reset_error.go
@@ -0,0 +1,19 @@
+// +build !appengine,!plan9
+
+package request
+
+import (
+	"net"
+	"os"
+	"syscall"
+)
+
+func isErrConnectionReset(err error) bool {
+	if opErr, ok := err.(*net.OpError); ok {
+		if sysErr, ok := opErr.Err.(*os.SyscallError); ok {
+			return sysErr.Err == syscall.ECONNRESET
+		}
+	}
+
+	return false
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/connection_reset_error_other.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/connection_reset_error_other.go
new file mode 100644
index 00000000..daf9eca4
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/connection_reset_error_other.go
@@ -0,0 +1,11 @@
+// +build appengine plan9
+
+package request
+
+import (
+	"strings"
+)
+
+func isErrConnectionReset(err error) bool {
+	return strings.Contains(err.Error(), "connection reset")
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/handlers.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/handlers.go
new file mode 100644
index 00000000..8ef8548a
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/handlers.go
@@ -0,0 +1,277 @@
+package request
+
+import (
+	"fmt"
+	"strings"
+)
+
+// A Handlers provides a collection of request handlers for various
+// stages of handling requests.
+type Handlers struct {
+	Validate         HandlerList
+	Build            HandlerList
+	Sign             HandlerList
+	Send             HandlerList
+	ValidateResponse HandlerList
+	Unmarshal        HandlerList
+	UnmarshalStream  HandlerList
+	UnmarshalMeta    HandlerList
+	UnmarshalError   HandlerList
+	Retry            HandlerList
+	AfterRetry       HandlerList
+	CompleteAttempt  HandlerList
+	Complete         HandlerList
+}
+
+// Copy returns of this handler's lists.
+func (h *Handlers) Copy() Handlers {
+	return Handlers{
+		Validate:         h.Validate.copy(),
+		Build:            h.Build.copy(),
+		Sign:             h.Sign.copy(),
+		Send:             h.Send.copy(),
+		ValidateResponse: h.ValidateResponse.copy(),
+		Unmarshal:        h.Unmarshal.copy(),
+		UnmarshalStream:  h.UnmarshalStream.copy(),
+		UnmarshalError:   h.UnmarshalError.copy(),
+		UnmarshalMeta:    h.UnmarshalMeta.copy(),
+		Retry:            h.Retry.copy(),
+		AfterRetry:       h.AfterRetry.copy(),
+		CompleteAttempt:  h.CompleteAttempt.copy(),
+		Complete:         h.Complete.copy(),
+	}
+}
+
+// Clear removes callback functions for all handlers
+func (h *Handlers) Clear() {
+	h.Validate.Clear()
+	h.Build.Clear()
+	h.Send.Clear()
+	h.Sign.Clear()
+	h.Unmarshal.Clear()
+	h.UnmarshalStream.Clear()
+	h.UnmarshalMeta.Clear()
+	h.UnmarshalError.Clear()
+	h.ValidateResponse.Clear()
+	h.Retry.Clear()
+	h.AfterRetry.Clear()
+	h.CompleteAttempt.Clear()
+	h.Complete.Clear()
+}
+
+// A HandlerListRunItem represents an entry in the HandlerList which
+// is being run.
+type HandlerListRunItem struct {
+	Index   int
+	Handler NamedHandler
+	Request *Request
+}
+
+// A HandlerList manages zero or more handlers in a list.
+type HandlerList struct {
+	list []NamedHandler
+
+	// Called after each request handler in the list is called. If set
+	// and the func returns true the HandlerList will continue to iterate
+	// over the request handlers. If false is returned the HandlerList
+	// will stop iterating.
+	//
+	// Should be used if extra logic to be performed between each handler
+	// in the list. This can be used to terminate a list's iteration
+	// based on a condition such as error like, HandlerListStopOnError.
+	// Or for logging like HandlerListLogItem.
+	AfterEachFn func(item HandlerListRunItem) bool
+}
+
+// A NamedHandler is a struct that contains a name and function callback.
+type NamedHandler struct {
+	Name string
+	Fn   func(*Request)
+}
+
+// copy creates a copy of the handler list.
+func (l *HandlerList) copy() HandlerList {
+	n := HandlerList{
+		AfterEachFn: l.AfterEachFn,
+	}
+	if len(l.list) == 0 {
+		return n
+	}
+
+	n.list = append(make([]NamedHandler, 0, len(l.list)), l.list...)
+	return n
+}
+
+// Clear clears the handler list.
+func (l *HandlerList) Clear() {
+	l.list = l.list[0:0]
+}
+
+// Len returns the number of handlers in the list.
+func (l *HandlerList) Len() int {
+	return len(l.list)
+}
+
+// PushBack pushes handler f to the back of the handler list.
+func (l *HandlerList) PushBack(f func(*Request)) {
+	l.PushBackNamed(NamedHandler{"__anonymous", f})
+}
+
+// PushBackNamed pushes named handler f to the back of the handler list.
+func (l *HandlerList) PushBackNamed(n NamedHandler) {
+	if cap(l.list) == 0 {
+		l.list = make([]NamedHandler, 0, 5)
+	}
+	l.list = append(l.list, n)
+}
+
+// PushFront pushes handler f to the front of the handler list.
+func (l *HandlerList) PushFront(f func(*Request)) {
+	l.PushFrontNamed(NamedHandler{"__anonymous", f})
+}
+
+// PushFrontNamed pushes named handler f to the front of the handler list.
+func (l *HandlerList) PushFrontNamed(n NamedHandler) {
+	if cap(l.list) == len(l.list) {
+		// Allocating new list required
+		l.list = append([]NamedHandler{n}, l.list...)
+	} else {
+		// Enough room to prepend into list.
+		l.list = append(l.list, NamedHandler{})
+		copy(l.list[1:], l.list)
+		l.list[0] = n
+	}
+}
+
+// Remove removes a NamedHandler n
+func (l *HandlerList) Remove(n NamedHandler) {
+	l.RemoveByName(n.Name)
+}
+
+// RemoveByName removes a NamedHandler by name.
+func (l *HandlerList) RemoveByName(name string) {
+	for i := 0; i < len(l.list); i++ {
+		m := l.list[i]
+		if m.Name == name {
+			// Shift array preventing creating new arrays
+			copy(l.list[i:], l.list[i+1:])
+			l.list[len(l.list)-1] = NamedHandler{}
+			l.list = l.list[:len(l.list)-1]
+
+			// decrement list so next check to length is correct
+			i--
+		}
+	}
+}
+
+// SwapNamed will swap out any existing handlers with the same name as the
+// passed in NamedHandler returning true if handlers were swapped. False is
+// returned otherwise.
+func (l *HandlerList) SwapNamed(n NamedHandler) (swapped bool) {
+	for i := 0; i < len(l.list); i++ {
+		if l.list[i].Name == n.Name {
+			l.list[i].Fn = n.Fn
+			swapped = true
+		}
+	}
+
+	return swapped
+}
+
+// Swap will swap out all handlers matching the name passed in. The matched
+// handlers will be swapped in. True is returned if the handlers were swapped.
+func (l *HandlerList) Swap(name string, replace NamedHandler) bool {
+	var swapped bool
+
+	for i := 0; i < len(l.list); i++ {
+		if l.list[i].Name == name {
+			l.list[i] = replace
+			swapped = true
+		}
+	}
+
+	return swapped
+}
+
+// SetBackNamed will replace the named handler if it exists in the handler list.
+// If the handler does not exist the handler will be added to the end of the list.
+func (l *HandlerList) SetBackNamed(n NamedHandler) {
+	if !l.SwapNamed(n) {
+		l.PushBackNamed(n)
+	}
+}
+
+// SetFrontNamed will replace the named handler if it exists in the handler list.
+// If the handler does not exist the handler will be added to the beginning of
+// the list.
+func (l *HandlerList) SetFrontNamed(n NamedHandler) {
+	if !l.SwapNamed(n) {
+		l.PushFrontNamed(n)
+	}
+}
+
+// Run executes all handlers in the list with a given request object.
+func (l *HandlerList) Run(r *Request) {
+	for i, h := range l.list {
+		h.Fn(r)
+		item := HandlerListRunItem{
+			Index: i, Handler: h, Request: r,
+		}
+		if l.AfterEachFn != nil && !l.AfterEachFn(item) {
+			return
+		}
+	}
+}
+
+// HandlerListLogItem logs the request handler and the state of the
+// request's Error value. Always returns true to continue iterating
+// request handlers in a HandlerList.
+func HandlerListLogItem(item HandlerListRunItem) bool {
+	if item.Request.Config.Logger == nil {
+		return true
+	}
+	item.Request.Config.Logger.Log("DEBUG: RequestHandler",
+		item.Index, item.Handler.Name, item.Request.Error)
+
+	return true
+}
+
+// HandlerListStopOnError returns false to stop the HandlerList iterating
+// over request handlers if Request.Error is not nil. True otherwise
+// to continue iterating.
+func HandlerListStopOnError(item HandlerListRunItem) bool {
+	return item.Request.Error == nil
+}
+
+// WithAppendUserAgent will add a string to the user agent prefixed with a
+// single white space.
+func WithAppendUserAgent(s string) Option {
+	return func(r *Request) {
+		r.Handlers.Build.PushBack(func(r2 *Request) {
+			AddToUserAgent(r, s)
+		})
+	}
+}
+
+// MakeAddToUserAgentHandler will add the name/version pair to the User-Agent request
+// header. If the extra parameters are provided they will be added as metadata to the
+// name/version pair resulting in the following format.
+// "name/version (extra0; extra1; ...)"
+// The user agent part will be concatenated with this current request's user agent string.
+func MakeAddToUserAgentHandler(name, version string, extra ...string) func(*Request) {
+	ua := fmt.Sprintf("%s/%s", name, version)
+	if len(extra) > 0 {
+		ua += fmt.Sprintf(" (%s)", strings.Join(extra, "; "))
+	}
+	return func(r *Request) {
+		AddToUserAgent(r, ua)
+	}
+}
+
+// MakeAddToUserAgentFreeFormHandler adds the input to the User-Agent request header.
+// The input string will be concatenated with the current request's user agent string.
+func MakeAddToUserAgentFreeFormHandler(s string) func(*Request) {
+	return func(r *Request) {
+		AddToUserAgent(r, s)
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/http_request.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/http_request.go
new file mode 100644
index 00000000..79f79602
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/http_request.go
@@ -0,0 +1,24 @@
+package request
+
+import (
+	"io"
+	"net/http"
+	"net/url"
+)
+
+func copyHTTPRequest(r *http.Request, body io.ReadCloser) *http.Request {
+	req := new(http.Request)
+	*req = *r
+	req.URL = &url.URL{}
+	*req.URL = *r.URL
+	req.Body = body
+
+	req.Header = http.Header{}
+	for k, v := range r.Header {
+		for _, vv := range v {
+			req.Header.Add(k, vv)
+		}
+	}
+
+	return req
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/offset_reader.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/offset_reader.go
new file mode 100644
index 00000000..b0c2ef4f
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/offset_reader.go
@@ -0,0 +1,60 @@
+package request
+
+import (
+	"io"
+	"sync"
+
+	"github.com/aws/aws-sdk-go/internal/sdkio"
+)
+
+// offsetReader is a thread-safe io.ReadCloser to prevent racing
+// with retrying requests
+type offsetReader struct {
+	buf    io.ReadSeeker
+	lock   sync.Mutex
+	closed bool
+}
+
+func newOffsetReader(buf io.ReadSeeker, offset int64) *offsetReader {
+	reader := &offsetReader{}
+	buf.Seek(offset, sdkio.SeekStart)
+
+	reader.buf = buf
+	return reader
+}
+
+// Close will close the instance of the offset reader's access to
+// the underlying io.ReadSeeker.
+func (o *offsetReader) Close() error {
+	o.lock.Lock()
+	defer o.lock.Unlock()
+	o.closed = true
+	return nil
+}
+
+// Read is a thread-safe read of the underlying io.ReadSeeker
+func (o *offsetReader) Read(p []byte) (int, error) {
+	o.lock.Lock()
+	defer o.lock.Unlock()
+
+	if o.closed {
+		return 0, io.EOF
+	}
+
+	return o.buf.Read(p)
+}
+
+// Seek is a thread-safe seeking operation.
+func (o *offsetReader) Seek(offset int64, whence int) (int64, error) {
+	o.lock.Lock()
+	defer o.lock.Unlock()
+
+	return o.buf.Seek(offset, whence)
+}
+
+// CloseAndCopy will return a new offsetReader with a copy of the old buffer
+// and close the old buffer.
+func (o *offsetReader) CloseAndCopy(offset int64) *offsetReader {
+	o.Close()
+	return newOffsetReader(o.buf, offset)
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/request.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/request.go
new file mode 100644
index 00000000..8f2eb3e4
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/request.go
@@ -0,0 +1,673 @@
+package request
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"reflect"
+	"strings"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/client/metadata"
+	"github.com/aws/aws-sdk-go/internal/sdkio"
+)
+
+const (
+	// ErrCodeSerialization is the serialization error code that is received
+	// during protocol unmarshaling.
+	ErrCodeSerialization = "SerializationError"
+
+	// ErrCodeRead is an error that is returned during HTTP reads.
+	ErrCodeRead = "ReadError"
+
+	// ErrCodeResponseTimeout is the connection timeout error that is received
+	// during body reads.
+	ErrCodeResponseTimeout = "ResponseTimeout"
+
+	// ErrCodeInvalidPresignExpire is returned when the expire time provided to
+	// presign is invalid
+	ErrCodeInvalidPresignExpire = "InvalidPresignExpireError"
+
+	// CanceledErrorCode is the error code that will be returned by an
+	// API request that was canceled. Requests given a aws.Context may
+	// return this error when canceled.
+	CanceledErrorCode = "RequestCanceled"
+)
+
+// A Request is the service request to be made.
+type Request struct {
+	Config     aws.Config
+	ClientInfo metadata.ClientInfo
+	Handlers   Handlers
+
+	Retryer
+	AttemptTime            time.Time
+	Time                   time.Time
+	Operation              *Operation
+	HTTPRequest            *http.Request
+	HTTPResponse           *http.Response
+	Body                   io.ReadSeeker
+	BodyStart              int64 // offset from beginning of Body that the request body starts
+	Params                 interface{}
+	Error                  error
+	Data                   interface{}
+	RequestID              string
+	RetryCount             int
+	Retryable              *bool
+	RetryDelay             time.Duration
+	NotHoist               bool
+	SignedHeaderVals       http.Header
+	LastSignedAt           time.Time
+	DisableFollowRedirects bool
+
+	// A value greater than 0 instructs the request to be signed as Presigned URL
+	// You should not set this field directly. Instead use Request's
+	// Presign or PresignRequest methods.
+	ExpireTime time.Duration
+
+	context aws.Context
+
+	built bool
+
+	// Need to persist an intermediate body between the input Body and HTTP
+	// request body because the HTTP Client's transport can maintain a reference
+	// to the HTTP request's body after the client has returned. This value is
+	// safe to use concurrently and wrap the input Body for each HTTP request.
+	safeBody *offsetReader
+}
+
+// An Operation is the service API operation to be made.
+type Operation struct {
+	Name       string
+	HTTPMethod string
+	HTTPPath   string
+	*Paginator
+
+	BeforePresignFn func(r *Request) error
+}
+
+// New returns a new Request pointer for the service API
+// operation and parameters.
+//
+// Params is any value of input parameters to be the request payload.
+// Data is pointer value to an object which the request's response
+// payload will be deserialized to.
+func New(cfg aws.Config, clientInfo metadata.ClientInfo, handlers Handlers,
+	retryer Retryer, operation *Operation, params interface{}, data interface{}) *Request {
+
+	method := operation.HTTPMethod
+	if method == "" {
+		method = "POST"
+	}
+
+	httpReq, _ := http.NewRequest(method, "", nil)
+
+	var err error
+	httpReq.URL, err = url.Parse(clientInfo.Endpoint + operation.HTTPPath)
+	if err != nil {
+		httpReq.URL = &url.URL{}
+		err = awserr.New("InvalidEndpointURL", "invalid endpoint uri", err)
+	}
+
+	SanitizeHostForHeader(httpReq)
+
+	r := &Request{
+		Config:     cfg,
+		ClientInfo: clientInfo,
+		Handlers:   handlers.Copy(),
+
+		Retryer:     retryer,
+		Time:        time.Now(),
+		ExpireTime:  0,
+		Operation:   operation,
+		HTTPRequest: httpReq,
+		Body:        nil,
+		Params:      params,
+		Error:       err,
+		Data:        data,
+	}
+	r.SetBufferBody([]byte{})
+
+	return r
+}
+
+// A Option is a functional option that can augment or modify a request when
+// using a WithContext API operation method.
+type Option func(*Request)
+
+// WithGetResponseHeader builds a request Option which will retrieve a single
+// header value from the HTTP Response. If there are multiple values for the
+// header key use WithGetResponseHeaders instead to access the http.Header
+// map directly. The passed in val pointer must be non-nil.
+//
+// This Option can be used multiple times with a single API operation.
+//
+//    var id2, versionID string
+//    svc.PutObjectWithContext(ctx, params,
+//        request.WithGetResponseHeader("x-amz-id-2", &id2),
+//        request.WithGetResponseHeader("x-amz-version-id", &versionID),
+//    )
+func WithGetResponseHeader(key string, val *string) Option {
+	return func(r *Request) {
+		r.Handlers.Complete.PushBack(func(req *Request) {
+			*val = req.HTTPResponse.Header.Get(key)
+		})
+	}
+}
+
+// WithGetResponseHeaders builds a request Option which will retrieve the
+// headers from the HTTP response and assign them to the passed in headers
+// variable. The passed in headers pointer must be non-nil.
+//
+//    var headers http.Header
+//    svc.PutObjectWithContext(ctx, params, request.WithGetResponseHeaders(&headers))
+func WithGetResponseHeaders(headers *http.Header) Option {
+	return func(r *Request) {
+		r.Handlers.Complete.PushBack(func(req *Request) {
+			*headers = req.HTTPResponse.Header
+		})
+	}
+}
+
+// WithLogLevel is a request option that will set the request to use a specific
+// log level when the request is made.
+//
+//     svc.PutObjectWithContext(ctx, params, request.WithLogLevel(aws.LogDebugWithHTTPBody)
+func WithLogLevel(l aws.LogLevelType) Option {
+	return func(r *Request) {
+		r.Config.LogLevel = aws.LogLevel(l)
+	}
+}
+
+// ApplyOptions will apply each option to the request calling them in the order
+// the were provided.
+func (r *Request) ApplyOptions(opts ...Option) {
+	for _, opt := range opts {
+		opt(r)
+	}
+}
+
+// Context will always returns a non-nil context. If Request does not have a
+// context aws.BackgroundContext will be returned.
+func (r *Request) Context() aws.Context {
+	if r.context != nil {
+		return r.context
+	}
+	return aws.BackgroundContext()
+}
+
+// SetContext adds a Context to the current request that can be used to cancel
+// a in-flight request. The Context value must not be nil, or this method will
+// panic.
+//
+// Unlike http.Request.WithContext, SetContext does not return a copy of the
+// Request. It is not safe to use use a single Request value for multiple
+// requests. A new Request should be created for each API operation request.
+//
+// Go 1.6 and below:
+// The http.Request's Cancel field will be set to the Done() value of
+// the context. This will overwrite the Cancel field's value.
+//
+// Go 1.7 and above:
+// The http.Request.WithContext will be used to set the context on the underlying
+// http.Request. This will create a shallow copy of the http.Request. The SDK
+// may create sub contexts in the future for nested requests such as retries.
+func (r *Request) SetContext(ctx aws.Context) {
+	if ctx == nil {
+		panic("context cannot be nil")
+	}
+	setRequestContext(r, ctx)
+}
+
+// WillRetry returns if the request's can be retried.
+func (r *Request) WillRetry() bool {
+	if !aws.IsReaderSeekable(r.Body) && r.HTTPRequest.Body != NoBody {
+		return false
+	}
+	return r.Error != nil && aws.BoolValue(r.Retryable) && r.RetryCount < r.MaxRetries()
+}
+
+// ParamsFilled returns if the request's parameters have been populated
+// and the parameters are valid. False is returned if no parameters are
+// provided or invalid.
+func (r *Request) ParamsFilled() bool {
+	return r.Params != nil && reflect.ValueOf(r.Params).Elem().IsValid()
+}
+
+// DataFilled returns true if the request's data for response deserialization
+// target has been set and is a valid. False is returned if data is not
+// set, or is invalid.
+func (r *Request) DataFilled() bool {
+	return r.Data != nil && reflect.ValueOf(r.Data).Elem().IsValid()
+}
+
+// SetBufferBody will set the request's body bytes that will be sent to
+// the service API.
+func (r *Request) SetBufferBody(buf []byte) {
+	r.SetReaderBody(bytes.NewReader(buf))
+}
+
+// SetStringBody sets the body of the request to be backed by a string.
+func (r *Request) SetStringBody(s string) {
+	r.SetReaderBody(strings.NewReader(s))
+}
+
+// SetReaderBody will set the request's body reader.
+func (r *Request) SetReaderBody(reader io.ReadSeeker) {
+	r.Body = reader
+	r.BodyStart, _ = reader.Seek(0, sdkio.SeekCurrent) // Get the Bodies current offset.
+	r.ResetBody()
+}
+
+// Presign returns the request's signed URL. Error will be returned
+// if the signing fails. The expire parameter is only used for presigned Amazon
+// S3 API requests. All other AWS services will use a fixed expiration
+// time of 15 minutes.
+//
+// It is invalid to create a presigned URL with a expire duration 0 or less. An
+// error is returned if expire duration is 0 or less.
+func (r *Request) Presign(expire time.Duration) (string, error) {
+	r = r.copy()
+
+	// Presign requires all headers be hoisted. There is no way to retrieve
+	// the signed headers not hoisted without this. Making the presigned URL
+	// useless.
+	r.NotHoist = false
+
+	u, _, err := getPresignedURL(r, expire)
+	return u, err
+}
+
+// PresignRequest behaves just like presign, with the addition of returning a
+// set of headers that were signed. The expire parameter is only used for
+// presigned Amazon S3 API requests. All other AWS services will use a fixed
+// expiration time of 15 minutes.
+//
+// It is invalid to create a presigned URL with a expire duration 0 or less. An
+// error is returned if expire duration is 0 or less.
+//
+// Returns the URL string for the API operation with signature in the query string,
+// and the HTTP headers that were included in the signature. These headers must
+// be included in any HTTP request made with the presigned URL.
+//
+// To prevent hoisting any headers to the query string set NotHoist to true on
+// this Request value prior to calling PresignRequest.
+func (r *Request) PresignRequest(expire time.Duration) (string, http.Header, error) {
+	r = r.copy()
+	return getPresignedURL(r, expire)
+}
+
+// IsPresigned returns true if the request represents a presigned API url.
+func (r *Request) IsPresigned() bool {
+	return r.ExpireTime != 0
+}
+
+func getPresignedURL(r *Request, expire time.Duration) (string, http.Header, error) {
+	if expire <= 0 {
+		return "", nil, awserr.New(
+			ErrCodeInvalidPresignExpire,
+			"presigned URL requires an expire duration greater than 0",
+			nil,
+		)
+	}
+
+	r.ExpireTime = expire
+
+	if r.Operation.BeforePresignFn != nil {
+		if err := r.Operation.BeforePresignFn(r); err != nil {
+			return "", nil, err
+		}
+	}
+
+	if err := r.Sign(); err != nil {
+		return "", nil, err
+	}
+
+	return r.HTTPRequest.URL.String(), r.SignedHeaderVals, nil
+}
+
+func debugLogReqError(r *Request, stage string, retrying bool, err error) {
+	if !r.Config.LogLevel.Matches(aws.LogDebugWithRequestErrors) {
+		return
+	}
+
+	retryStr := "not retrying"
+	if retrying {
+		retryStr = "will retry"
+	}
+
+	r.Config.Logger.Log(fmt.Sprintf("DEBUG: %s %s/%s failed, %s, error %v",
+		stage, r.ClientInfo.ServiceName, r.Operation.Name, retryStr, err))
+}
+
+// Build will build the request's object so it can be signed and sent
+// to the service. Build will also validate all the request's parameters.
+// Any additional build Handlers set on this request will be run
+// in the order they were set.
+//
+// The request will only be built once. Multiple calls to build will have
+// no effect.
+//
+// If any Validate or Build errors occur the build will stop and the error
+// which occurred will be returned.
+func (r *Request) Build() error {
+	if !r.built {
+		r.Handlers.Validate.Run(r)
+		if r.Error != nil {
+			debugLogReqError(r, "Validate Request", false, r.Error)
+			return r.Error
+		}
+		r.Handlers.Build.Run(r)
+		if r.Error != nil {
+			debugLogReqError(r, "Build Request", false, r.Error)
+			return r.Error
+		}
+		r.built = true
+	}
+
+	return r.Error
+}
+
+// Sign will sign the request, returning error if errors are encountered.
+//
+// Sign will build the request prior to signing. All Sign Handlers will
+// be executed in the order they were set.
+func (r *Request) Sign() error {
+	r.Build()
+	if r.Error != nil {
+		debugLogReqError(r, "Build Request", false, r.Error)
+		return r.Error
+	}
+
+	r.Handlers.Sign.Run(r)
+	return r.Error
+}
+
+func (r *Request) getNextRequestBody() (io.ReadCloser, error) {
+	if r.safeBody != nil {
+		r.safeBody.Close()
+	}
+
+	r.safeBody = newOffsetReader(r.Body, r.BodyStart)
+
+	// Go 1.8 tightened and clarified the rules code needs to use when building
+	// requests with the http package. Go 1.8 removed the automatic detection
+	// of if the Request.Body was empty, or actually had bytes in it. The SDK
+	// always sets the Request.Body even if it is empty and should not actually
+	// be sent. This is incorrect.
+	//
+	// Go 1.8 did add a http.NoBody value that the SDK can use to tell the http
+	// client that the request really should be sent without a body. The
+	// Request.Body cannot be set to nil, which is preferable, because the
+	// field is exported and could introduce nil pointer dereferences for users
+	// of the SDK if they used that field.
+	//
+	// Related golang/go#18257
+	l, err := aws.SeekerLen(r.Body)
+	if err != nil {
+		return nil, awserr.New(ErrCodeSerialization, "failed to compute request body size", err)
+	}
+
+	var body io.ReadCloser
+	if l == 0 {
+		body = NoBody
+	} else if l > 0 {
+		body = r.safeBody
+	} else {
+		// Hack to prevent sending bodies for methods where the body
+		// should be ignored by the server. Sending bodies on these
+		// methods without an associated ContentLength will cause the
+		// request to socket timeout because the server does not handle
+		// Transfer-Encoding: chunked bodies for these methods.
+		//
+		// This would only happen if a aws.ReaderSeekerCloser was used with
+		// a io.Reader that was not also an io.Seeker, or did not implement
+		// Len() method.
+		switch r.Operation.HTTPMethod {
+		case "GET", "HEAD", "DELETE":
+			body = NoBody
+		default:
+			body = r.safeBody
+		}
+	}
+
+	return body, nil
+}
+
+// GetBody will return an io.ReadSeeker of the Request's underlying
+// input body with a concurrency safe wrapper.
+func (r *Request) GetBody() io.ReadSeeker {
+	return r.safeBody
+}
+
+// Send will send the request, returning error if errors are encountered.
+//
+// Send will sign the request prior to sending. All Send Handlers will
+// be executed in the order they were set.
+//
+// Canceling a request is non-deterministic. If a request has been canceled,
+// then the transport will choose, randomly, one of the state channels during
+// reads or getting the connection.
+//
+// readLoop() and getConn(req *Request, cm connectMethod)
+// https://github.com/golang/go/blob/master/src/net/http/transport.go
+//
+// Send will not close the request.Request's body.
+func (r *Request) Send() error {
+	defer func() {
+		// Regardless of success or failure of the request trigger the Complete
+		// request handlers.
+		r.Handlers.Complete.Run(r)
+	}()
+
+	if err := r.Error; err != nil {
+		return err
+	}
+
+	for {
+		r.Error = nil
+		r.AttemptTime = time.Now()
+
+		if err := r.Sign(); err != nil {
+			debugLogReqError(r, "Sign Request", false, err)
+			return err
+		}
+
+		if err := r.sendRequest(); err == nil {
+			return nil
+		} else if !shouldRetryCancel(r.Error) {
+			return err
+		} else {
+			r.Handlers.Retry.Run(r)
+			r.Handlers.AfterRetry.Run(r)
+
+			if r.Error != nil || !aws.BoolValue(r.Retryable) {
+				return r.Error
+			}
+
+			r.prepareRetry()
+			continue
+		}
+	}
+}
+
+func (r *Request) prepareRetry() {
+	if r.Config.LogLevel.Matches(aws.LogDebugWithRequestRetries) {
+		r.Config.Logger.Log(fmt.Sprintf("DEBUG: Retrying Request %s/%s, attempt %d",
+			r.ClientInfo.ServiceName, r.Operation.Name, r.RetryCount))
+	}
+
+	// The previous http.Request will have a reference to the r.Body
+	// and the HTTP Client's Transport may still be reading from
+	// the request's body even though the Client's Do returned.
+	r.HTTPRequest = copyHTTPRequest(r.HTTPRequest, nil)
+	r.ResetBody()
+
+	// Closing response body to ensure that no response body is leaked
+	// between retry attempts.
+	if r.HTTPResponse != nil && r.HTTPResponse.Body != nil {
+		r.HTTPResponse.Body.Close()
+	}
+}
+
+func (r *Request) sendRequest() (sendErr error) {
+	defer r.Handlers.CompleteAttempt.Run(r)
+
+	r.Retryable = nil
+	r.Handlers.Send.Run(r)
+	if r.Error != nil {
+		debugLogReqError(r, "Send Request", r.WillRetry(), r.Error)
+		return r.Error
+	}
+
+	r.Handlers.UnmarshalMeta.Run(r)
+	r.Handlers.ValidateResponse.Run(r)
+	if r.Error != nil {
+		r.Handlers.UnmarshalError.Run(r)
+		debugLogReqError(r, "Validate Response", r.WillRetry(), r.Error)
+		return r.Error
+	}
+
+	r.Handlers.Unmarshal.Run(r)
+	if r.Error != nil {
+		debugLogReqError(r, "Unmarshal Response", r.WillRetry(), r.Error)
+		return r.Error
+	}
+
+	return nil
+}
+
+// copy will copy a request which will allow for local manipulation of the
+// request.
+func (r *Request) copy() *Request {
+	req := &Request{}
+	*req = *r
+	req.Handlers = r.Handlers.Copy()
+	op := *r.Operation
+	req.Operation = &op
+	return req
+}
+
+// AddToUserAgent adds the string to the end of the request's current user agent.
+func AddToUserAgent(r *Request, s string) {
+	curUA := r.HTTPRequest.Header.Get("User-Agent")
+	if len(curUA) > 0 {
+		s = curUA + " " + s
+	}
+	r.HTTPRequest.Header.Set("User-Agent", s)
+}
+
+type temporary interface {
+	Temporary() bool
+}
+
+func shouldRetryCancel(err error) bool {
+	switch err := err.(type) {
+	case awserr.Error:
+		if err.Code() == CanceledErrorCode {
+			return false
+		}
+		return shouldRetryCancel(err.OrigErr())
+	case *url.Error:
+		if strings.Contains(err.Error(), "connection refused") {
+			// Refused connections should be retried as the service may not yet
+			// be running on the port. Go TCP dial considers refused
+			// connections as not temporary.
+			return true
+		}
+		// *url.Error only implements Temporary after golang 1.6 but since
+		// url.Error only wraps the error:
+		return shouldRetryCancel(err.Err)
+	case temporary:
+		// If the error is temporary, we want to allow continuation of the
+		// retry process
+		return err.Temporary()
+	case nil:
+		// `awserr.Error.OrigErr()` can be nil, meaning there was an error but
+		// because we don't know the cause, it is marked as retriable. See
+		// TestRequest4xxUnretryable for an example.
+		return true
+	default:
+		switch err.Error() {
+		case "net/http: request canceled",
+			"net/http: request canceled while waiting for connection":
+			// known 1.5 error case when an http request is cancelled
+			return false
+		}
+		// here we don't know the error; so we allow a retry.
+		return true
+	}
+}
+
+// SanitizeHostForHeader removes default port from host and updates request.Host
+func SanitizeHostForHeader(r *http.Request) {
+	host := getHost(r)
+	port := portOnly(host)
+	if port != "" && isDefaultPort(r.URL.Scheme, port) {
+		r.Host = stripPort(host)
+	}
+}
+
+// Returns host from request
+func getHost(r *http.Request) string {
+	if r.Host != "" {
+		return r.Host
+	}
+
+	return r.URL.Host
+}
+
+// Hostname returns u.Host, without any port number.
+//
+// If Host is an IPv6 literal with a port number, Hostname returns the
+// IPv6 literal without the square brackets. IPv6 literals may include
+// a zone identifier.
+//
+// Copied from the Go 1.8 standard library (net/url)
+func stripPort(hostport string) string {
+	colon := strings.IndexByte(hostport, ':')
+	if colon == -1 {
+		return hostport
+	}
+	if i := strings.IndexByte(hostport, ']'); i != -1 {
+		return strings.TrimPrefix(hostport[:i], "[")
+	}
+	return hostport[:colon]
+}
+
+// Port returns the port part of u.Host, without the leading colon.
+// If u.Host doesn't contain a port, Port returns an empty string.
+//
+// Copied from the Go 1.8 standard library (net/url)
+func portOnly(hostport string) string {
+	colon := strings.IndexByte(hostport, ':')
+	if colon == -1 {
+		return ""
+	}
+	if i := strings.Index(hostport, "]:"); i != -1 {
+		return hostport[i+len("]:"):]
+	}
+	if strings.Contains(hostport, "]") {
+		return ""
+	}
+	return hostport[colon+len(":"):]
+}
+
+// Returns true if the specified URI is using the standard port
+// (i.e. port 80 for HTTP URIs or 443 for HTTPS URIs)
+func isDefaultPort(scheme, port string) bool {
+	if port == "" {
+		return true
+	}
+
+	lowerCaseScheme := strings.ToLower(scheme)
+	if (lowerCaseScheme == "http" && port == "80") || (lowerCaseScheme == "https" && port == "443") {
+		return true
+	}
+
+	return false
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/request_1_7.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/request_1_7.go
new file mode 100644
index 00000000..e36e468b
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/request_1_7.go
@@ -0,0 +1,39 @@
+// +build !go1.8
+
+package request
+
+import "io"
+
+// NoBody is an io.ReadCloser with no bytes. Read always returns EOF
+// and Close always returns nil. It can be used in an outgoing client
+// request to explicitly signal that a request has zero bytes.
+// An alternative, however, is to simply set Request.Body to nil.
+//
+// Copy of Go 1.8 NoBody type from net/http/http.go
+type noBody struct{}
+
+func (noBody) Read([]byte) (int, error)         { return 0, io.EOF }
+func (noBody) Close() error                     { return nil }
+func (noBody) WriteTo(io.Writer) (int64, error) { return 0, nil }
+
+// NoBody is an empty reader that will trigger the Go HTTP client to not include
+// and body in the HTTP request.
+var NoBody = noBody{}
+
+// ResetBody rewinds the request body back to its starting position, and
+// sets the HTTP Request body reference. When the body is read prior
+// to being sent in the HTTP request it will need to be rewound.
+//
+// ResetBody will automatically be called by the SDK's build handler, but if
+// the request is being used directly ResetBody must be called before the request
+// is Sent.  SetStringBody, SetBufferBody, and SetReaderBody will automatically
+// call ResetBody.
+func (r *Request) ResetBody() {
+	body, err := r.getNextRequestBody()
+	if err != nil {
+		r.Error = err
+		return
+	}
+
+	r.HTTPRequest.Body = body
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/request_1_8.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/request_1_8.go
new file mode 100644
index 00000000..7c6a8000
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/request_1_8.go
@@ -0,0 +1,33 @@
+// +build go1.8
+
+package request
+
+import (
+	"net/http"
+)
+
+// NoBody is a http.NoBody reader instructing Go HTTP client to not include
+// and body in the HTTP request.
+var NoBody = http.NoBody
+
+// ResetBody rewinds the request body back to its starting position, and
+// sets the HTTP Request body reference. When the body is read prior
+// to being sent in the HTTP request it will need to be rewound.
+//
+// ResetBody will automatically be called by the SDK's build handler, but if
+// the request is being used directly ResetBody must be called before the request
+// is Sent.  SetStringBody, SetBufferBody, and SetReaderBody will automatically
+// call ResetBody.
+//
+// Will also set the Go 1.8's http.Request.GetBody member to allow retrying
+// PUT/POST redirects.
+func (r *Request) ResetBody() {
+	body, err := r.getNextRequestBody()
+	if err != nil {
+		r.Error = err
+		return
+	}
+
+	r.HTTPRequest.Body = body
+	r.HTTPRequest.GetBody = r.getNextRequestBody
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/request_context.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/request_context.go
new file mode 100644
index 00000000..a7365cd1
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/request_context.go
@@ -0,0 +1,14 @@
+// +build go1.7
+
+package request
+
+import "github.com/aws/aws-sdk-go/aws"
+
+// setContext updates the Request to use the passed in context for cancellation.
+// Context will also be used for request retry delay.
+//
+// Creates shallow copy of the http.Request with the WithContext method.
+func setRequestContext(r *Request, ctx aws.Context) {
+	r.context = ctx
+	r.HTTPRequest = r.HTTPRequest.WithContext(ctx)
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/request_context_1_6.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/request_context_1_6.go
new file mode 100644
index 00000000..307fa070
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/request_context_1_6.go
@@ -0,0 +1,14 @@
+// +build !go1.7
+
+package request
+
+import "github.com/aws/aws-sdk-go/aws"
+
+// setContext updates the Request to use the passed in context for cancellation.
+// Context will also be used for request retry delay.
+//
+// Creates shallow copy of the http.Request with the WithContext method.
+func setRequestContext(r *Request, ctx aws.Context) {
+	r.context = ctx
+	r.HTTPRequest.Cancel = ctx.Done()
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/request_pagination.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/request_pagination.go
new file mode 100644
index 00000000..a633ed5a
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/request_pagination.go
@@ -0,0 +1,264 @@
+package request
+
+import (
+	"reflect"
+	"sync/atomic"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awsutil"
+)
+
+// A Pagination provides paginating of SDK API operations which are paginatable.
+// Generally you should not use this type directly, but use the "Pages" API
+// operations method to automatically perform pagination for you. Such as,
+// "S3.ListObjectsPages", and "S3.ListObjectsPagesWithContext" methods.
+//
+// Pagination differs from a Paginator type in that pagination is the type that
+// does the pagination between API operations, and Paginator defines the
+// configuration that will be used per page request.
+//
+//     cont := true
+//     for p.Next() && cont {
+//         data := p.Page().(*s3.ListObjectsOutput)
+//         // process the page's data
+//     }
+//     return p.Err()
+//
+// See service client API operation Pages methods for examples how the SDK will
+// use the Pagination type.
+type Pagination struct {
+	// Function to return a Request value for each pagination request.
+	// Any configuration or handlers that need to be applied to the request
+	// prior to getting the next page should be done here before the request
+	// returned.
+	//
+	// NewRequest should always be built from the same API operations. It is
+	// undefined if different API operations are returned on subsequent calls.
+	NewRequest func() (*Request, error)
+	// EndPageOnSameToken, when enabled, will allow the paginator to stop on
+	// token that are the same as its previous tokens.
+	EndPageOnSameToken bool
+
+	started    bool
+	prevTokens []interface{}
+	nextTokens []interface{}
+
+	err     error
+	curPage interface{}
+}
+
+// HasNextPage will return true if Pagination is able to determine that the API
+// operation has additional pages. False will be returned if there are no more
+// pages remaining.
+//
+// Will always return true if Next has not been called yet.
+func (p *Pagination) HasNextPage() bool {
+	if !p.started {
+		return true
+	}
+
+	hasNextPage := len(p.nextTokens) != 0
+	if p.EndPageOnSameToken {
+		return hasNextPage && !awsutil.DeepEqual(p.nextTokens, p.prevTokens)
+	}
+	return hasNextPage
+}
+
+// Err returns the error Pagination encountered when retrieving the next page.
+func (p *Pagination) Err() error {
+	return p.err
+}
+
+// Page returns the current page. Page should only be called after a successful
+// call to Next. It is undefined what Page will return if Page is called after
+// Next returns false.
+func (p *Pagination) Page() interface{} {
+	return p.curPage
+}
+
+// Next will attempt to retrieve the next page for the API operation. When a page
+// is retrieved true will be returned. If the page cannot be retrieved, or there
+// are no more pages false will be returned.
+//
+// Use the Page method to retrieve the current page data. The data will need
+// to be cast to the API operation's output type.
+//
+// Use the Err method to determine if an error occurred if Page returns false.
+func (p *Pagination) Next() bool {
+	if !p.HasNextPage() {
+		return false
+	}
+
+	req, err := p.NewRequest()
+	if err != nil {
+		p.err = err
+		return false
+	}
+
+	if p.started {
+		for i, intok := range req.Operation.InputTokens {
+			awsutil.SetValueAtPath(req.Params, intok, p.nextTokens[i])
+		}
+	}
+	p.started = true
+
+	err = req.Send()
+	if err != nil {
+		p.err = err
+		return false
+	}
+
+	p.prevTokens = p.nextTokens
+	p.nextTokens = req.nextPageTokens()
+	p.curPage = req.Data
+
+	return true
+}
+
+// A Paginator is the configuration data that defines how an API operation
+// should be paginated. This type is used by the API service models to define
+// the generated pagination config for service APIs.
+//
+// The Pagination type is what provides iterating between pages of an API. It
+// is only used to store the token metadata the SDK should use for performing
+// pagination.
+type Paginator struct {
+	InputTokens     []string
+	OutputTokens    []string
+	LimitToken      string
+	TruncationToken string
+}
+
+// nextPageTokens returns the tokens to use when asking for the next page of data.
+func (r *Request) nextPageTokens() []interface{} {
+	if r.Operation.Paginator == nil {
+		return nil
+	}
+	if r.Operation.TruncationToken != "" {
+		tr, _ := awsutil.ValuesAtPath(r.Data, r.Operation.TruncationToken)
+		if len(tr) == 0 {
+			return nil
+		}
+
+		switch v := tr[0].(type) {
+		case *bool:
+			if !aws.BoolValue(v) {
+				return nil
+			}
+		case bool:
+			if v == false {
+				return nil
+			}
+		}
+	}
+
+	tokens := []interface{}{}
+	tokenAdded := false
+	for _, outToken := range r.Operation.OutputTokens {
+		vs, _ := awsutil.ValuesAtPath(r.Data, outToken)
+		if len(vs) == 0 {
+			tokens = append(tokens, nil)
+			continue
+		}
+		v := vs[0]
+
+		switch tv := v.(type) {
+		case *string:
+			if len(aws.StringValue(tv)) == 0 {
+				tokens = append(tokens, nil)
+				continue
+			}
+		case string:
+			if len(tv) == 0 {
+				tokens = append(tokens, nil)
+				continue
+			}
+		}
+
+		tokenAdded = true
+		tokens = append(tokens, v)
+	}
+	if !tokenAdded {
+		return nil
+	}
+
+	return tokens
+}
+
+// Ensure a deprecated item is only logged once instead of each time its used.
+func logDeprecatedf(logger aws.Logger, flag *int32, msg string) {
+	if logger == nil {
+		return
+	}
+	if atomic.CompareAndSwapInt32(flag, 0, 1) {
+		logger.Log(msg)
+	}
+}
+
+var (
+	logDeprecatedHasNextPage int32
+	logDeprecatedNextPage    int32
+	logDeprecatedEachPage    int32
+)
+
+// HasNextPage returns true if this request has more pages of data available.
+//
+// Deprecated Use Pagination type for configurable pagination of API operations
+func (r *Request) HasNextPage() bool {
+	logDeprecatedf(r.Config.Logger, &logDeprecatedHasNextPage,
+		"Request.HasNextPage deprecated. Use Pagination type for configurable pagination of API operations")
+
+	return len(r.nextPageTokens()) > 0
+}
+
+// NextPage returns a new Request that can be executed to return the next
+// page of result data. Call .Send() on this request to execute it.
+//
+// Deprecated Use Pagination type for configurable pagination of API operations
+func (r *Request) NextPage() *Request {
+	logDeprecatedf(r.Config.Logger, &logDeprecatedNextPage,
+		"Request.NextPage deprecated. Use Pagination type for configurable pagination of API operations")
+
+	tokens := r.nextPageTokens()
+	if len(tokens) == 0 {
+		return nil
+	}
+
+	data := reflect.New(reflect.TypeOf(r.Data).Elem()).Interface()
+	nr := New(r.Config, r.ClientInfo, r.Handlers, r.Retryer, r.Operation, awsutil.CopyOf(r.Params), data)
+	for i, intok := range nr.Operation.InputTokens {
+		awsutil.SetValueAtPath(nr.Params, intok, tokens[i])
+	}
+	return nr
+}
+
+// EachPage iterates over each page of a paginated request object. The fn
+// parameter should be a function with the following sample signature:
+//
+//   func(page *T, lastPage bool) bool {
+//       return true // return false to stop iterating
+//   }
+//
+// Where "T" is the structure type matching the output structure of the given
+// operation. For example, a request object generated by
+// DynamoDB.ListTablesRequest() would expect to see dynamodb.ListTablesOutput
+// as the structure "T". The lastPage value represents whether the page is
+// the last page of data or not. The return value of this function should
+// return true to keep iterating or false to stop.
+//
+// Deprecated Use Pagination type for configurable pagination of API operations
+func (r *Request) EachPage(fn func(data interface{}, isLastPage bool) (shouldContinue bool)) error {
+	logDeprecatedf(r.Config.Logger, &logDeprecatedEachPage,
+		"Request.EachPage deprecated. Use Pagination type for configurable pagination of API operations")
+
+	for page := r; page != nil; page = page.NextPage() {
+		if err := page.Send(); err != nil {
+			return err
+		}
+		if getNextPage := fn(page.Data, !page.HasNextPage()); !getNextPage {
+			return page.Error
+		}
+	}
+
+	return nil
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/retryer.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/retryer.go
new file mode 100644
index 00000000..d0aa54c6
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/retryer.go
@@ -0,0 +1,163 @@
+package request
+
+import (
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+)
+
+// Retryer is an interface to control retry logic for a given service.
+// The default implementation used by most services is the client.DefaultRetryer
+// structure, which contains basic retry logic using exponential backoff.
+type Retryer interface {
+	RetryRules(*Request) time.Duration
+	ShouldRetry(*Request) bool
+	MaxRetries() int
+}
+
+// WithRetryer sets a config Retryer value to the given Config returning it
+// for chaining.
+func WithRetryer(cfg *aws.Config, retryer Retryer) *aws.Config {
+	cfg.Retryer = retryer
+	return cfg
+}
+
+// retryableCodes is a collection of service response codes which are retry-able
+// without any further action.
+var retryableCodes = map[string]struct{}{
+	"RequestError":            {},
+	"RequestTimeout":          {},
+	ErrCodeResponseTimeout:    {},
+	"RequestTimeoutException": {}, // Glacier's flavor of RequestTimeout
+}
+
+var throttleCodes = map[string]struct{}{
+	"ProvisionedThroughputExceededException": {},
+	"Throttling":                             {},
+	"ThrottlingException":                    {},
+	"RequestLimitExceeded":                   {},
+	"RequestThrottled":                       {},
+	"RequestThrottledException":              {},
+	"TooManyRequestsException":               {}, // Lambda functions
+	"PriorRequestNotComplete":                {}, // Route53
+	"TransactionInProgressException":         {},
+}
+
+// credsExpiredCodes is a collection of error codes which signify the credentials
+// need to be refreshed. Expired tokens require refreshing of credentials, and
+// resigning before the request can be retried.
+var credsExpiredCodes = map[string]struct{}{
+	"ExpiredToken":          {},
+	"ExpiredTokenException": {},
+	"RequestExpired":        {}, // EC2 Only
+}
+
+func isCodeThrottle(code string) bool {
+	_, ok := throttleCodes[code]
+	return ok
+}
+
+func isCodeRetryable(code string) bool {
+	if _, ok := retryableCodes[code]; ok {
+		return true
+	}
+
+	return isCodeExpiredCreds(code)
+}
+
+func isCodeExpiredCreds(code string) bool {
+	_, ok := credsExpiredCodes[code]
+	return ok
+}
+
+var validParentCodes = map[string]struct{}{
+	ErrCodeSerialization: {},
+	ErrCodeRead:          {},
+}
+
+type temporaryError interface {
+	Temporary() bool
+}
+
+func isNestedErrorRetryable(parentErr awserr.Error) bool {
+	if parentErr == nil {
+		return false
+	}
+
+	if _, ok := validParentCodes[parentErr.Code()]; !ok {
+		return false
+	}
+
+	err := parentErr.OrigErr()
+	if err == nil {
+		return false
+	}
+
+	if aerr, ok := err.(awserr.Error); ok {
+		return isCodeRetryable(aerr.Code())
+	}
+
+	if t, ok := err.(temporaryError); ok {
+		return t.Temporary() || isErrConnectionReset(err)
+	}
+
+	return isErrConnectionReset(err)
+}
+
+// IsErrorRetryable returns whether the error is retryable, based on its Code.
+// Returns false if error is nil.
+func IsErrorRetryable(err error) bool {
+	if err != nil {
+		if aerr, ok := err.(awserr.Error); ok {
+			return isCodeRetryable(aerr.Code()) || isNestedErrorRetryable(aerr)
+		}
+	}
+	return false
+}
+
+// IsErrorThrottle returns whether the error is to be throttled based on its code.
+// Returns false if error is nil.
+func IsErrorThrottle(err error) bool {
+	if err != nil {
+		if aerr, ok := err.(awserr.Error); ok {
+			return isCodeThrottle(aerr.Code())
+		}
+	}
+	return false
+}
+
+// IsErrorExpiredCreds returns whether the error code is a credential expiry error.
+// Returns false if error is nil.
+func IsErrorExpiredCreds(err error) bool {
+	if err != nil {
+		if aerr, ok := err.(awserr.Error); ok {
+			return isCodeExpiredCreds(aerr.Code())
+		}
+	}
+	return false
+}
+
+// IsErrorRetryable returns whether the error is retryable, based on its Code.
+// Returns false if the request has no Error set.
+//
+// Alias for the utility function IsErrorRetryable
+func (r *Request) IsErrorRetryable() bool {
+	return IsErrorRetryable(r.Error)
+}
+
+// IsErrorThrottle returns whether the error is to be throttled based on its code.
+// Returns false if the request has no Error set
+//
+// Alias for the utility function IsErrorThrottle
+func (r *Request) IsErrorThrottle() bool {
+	return IsErrorThrottle(r.Error)
+}
+
+// IsErrorExpired returns whether the error code is a credential expiry error.
+// Returns false if the request has no Error set.
+//
+// Alias for the utility function IsErrorExpiredCreds
+func (r *Request) IsErrorExpired() bool {
+	return IsErrorExpiredCreds(r.Error)
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/timeout_read_closer.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/timeout_read_closer.go
new file mode 100644
index 00000000..09a44eb9
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/timeout_read_closer.go
@@ -0,0 +1,94 @@
+package request
+
+import (
+	"io"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws/awserr"
+)
+
+var timeoutErr = awserr.New(
+	ErrCodeResponseTimeout,
+	"read on body has reached the timeout limit",
+	nil,
+)
+
+type readResult struct {
+	n   int
+	err error
+}
+
+// timeoutReadCloser will handle body reads that take too long.
+// We will return a ErrReadTimeout error if a timeout occurs.
+type timeoutReadCloser struct {
+	reader   io.ReadCloser
+	duration time.Duration
+}
+
+// Read will spin off a goroutine to call the reader's Read method. We will
+// select on the timer's channel or the read's channel. Whoever completes first
+// will be returned.
+func (r *timeoutReadCloser) Read(b []byte) (int, error) {
+	timer := time.NewTimer(r.duration)
+	c := make(chan readResult, 1)
+
+	go func() {
+		n, err := r.reader.Read(b)
+		timer.Stop()
+		c <- readResult{n: n, err: err}
+	}()
+
+	select {
+	case data := <-c:
+		return data.n, data.err
+	case <-timer.C:
+		return 0, timeoutErr
+	}
+}
+
+func (r *timeoutReadCloser) Close() error {
+	return r.reader.Close()
+}
+
+const (
+	// HandlerResponseTimeout is what we use to signify the name of the
+	// response timeout handler.
+	HandlerResponseTimeout = "ResponseTimeoutHandler"
+)
+
+// adaptToResponseTimeoutError is a handler that will replace any top level error
+// to a ErrCodeResponseTimeout, if its child is that.
+func adaptToResponseTimeoutError(req *Request) {
+	if err, ok := req.Error.(awserr.Error); ok {
+		aerr, ok := err.OrigErr().(awserr.Error)
+		if ok && aerr.Code() == ErrCodeResponseTimeout {
+			req.Error = aerr
+		}
+	}
+}
+
+// WithResponseReadTimeout is a request option that will wrap the body in a timeout read closer.
+// This will allow for per read timeouts. If a timeout occurred, we will return the
+// ErrCodeResponseTimeout.
+//
+//     svc.PutObjectWithContext(ctx, params, request.WithTimeoutReadCloser(30 * time.Second)
+func WithResponseReadTimeout(duration time.Duration) Option {
+	return func(r *Request) {
+
+		var timeoutHandler = NamedHandler{
+			HandlerResponseTimeout,
+			func(req *Request) {
+				req.HTTPResponse.Body = &timeoutReadCloser{
+					reader:   req.HTTPResponse.Body,
+					duration: duration,
+				}
+			}}
+
+		// remove the handler so we are not stomping over any new durations.
+		r.Handlers.Send.RemoveByName(HandlerResponseTimeout)
+		r.Handlers.Send.PushBackNamed(timeoutHandler)
+
+		r.Handlers.Unmarshal.PushBack(adaptToResponseTimeoutError)
+		r.Handlers.UnmarshalError.PushBack(adaptToResponseTimeoutError)
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/validation.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/validation.go
new file mode 100644
index 00000000..8630683f
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/validation.go
@@ -0,0 +1,286 @@
+package request
+
+import (
+	"bytes"
+	"fmt"
+
+	"github.com/aws/aws-sdk-go/aws/awserr"
+)
+
+const (
+	// InvalidParameterErrCode is the error code for invalid parameters errors
+	InvalidParameterErrCode = "InvalidParameter"
+	// ParamRequiredErrCode is the error code for required parameter errors
+	ParamRequiredErrCode = "ParamRequiredError"
+	// ParamMinValueErrCode is the error code for fields with too low of a
+	// number value.
+	ParamMinValueErrCode = "ParamMinValueError"
+	// ParamMinLenErrCode is the error code for fields without enough elements.
+	ParamMinLenErrCode = "ParamMinLenError"
+	// ParamMaxLenErrCode is the error code for value being too long.
+	ParamMaxLenErrCode = "ParamMaxLenError"
+
+	// ParamFormatErrCode is the error code for a field with invalid
+	// format or characters.
+	ParamFormatErrCode = "ParamFormatInvalidError"
+)
+
+// Validator provides a way for types to perform validation logic on their
+// input values that external code can use to determine if a type's values
+// are valid.
+type Validator interface {
+	Validate() error
+}
+
+// An ErrInvalidParams provides wrapping of invalid parameter errors found when
+// validating API operation input parameters.
+type ErrInvalidParams struct {
+	// Context is the base context of the invalid parameter group.
+	Context string
+	errs    []ErrInvalidParam
+}
+
+// Add adds a new invalid parameter error to the collection of invalid
+// parameters. The context of the invalid parameter will be updated to reflect
+// this collection.
+func (e *ErrInvalidParams) Add(err ErrInvalidParam) {
+	err.SetContext(e.Context)
+	e.errs = append(e.errs, err)
+}
+
+// AddNested adds the invalid parameter errors from another ErrInvalidParams
+// value into this collection. The nested errors will have their nested context
+// updated and base context to reflect the merging.
+//
+// Use for nested validations errors.
+func (e *ErrInvalidParams) AddNested(nestedCtx string, nested ErrInvalidParams) {
+	for _, err := range nested.errs {
+		err.SetContext(e.Context)
+		err.AddNestedContext(nestedCtx)
+		e.errs = append(e.errs, err)
+	}
+}
+
+// Len returns the number of invalid parameter errors
+func (e ErrInvalidParams) Len() int {
+	return len(e.errs)
+}
+
+// Code returns the code of the error
+func (e ErrInvalidParams) Code() string {
+	return InvalidParameterErrCode
+}
+
+// Message returns the message of the error
+func (e ErrInvalidParams) Message() string {
+	return fmt.Sprintf("%d validation error(s) found.", len(e.errs))
+}
+
+// Error returns the string formatted form of the invalid parameters.
+func (e ErrInvalidParams) Error() string {
+	w := &bytes.Buffer{}
+	fmt.Fprintf(w, "%s: %s\n", e.Code(), e.Message())
+
+	for _, err := range e.errs {
+		fmt.Fprintf(w, "- %s\n", err.Message())
+	}
+
+	return w.String()
+}
+
+// OrigErr returns the invalid parameters as a awserr.BatchedErrors value
+func (e ErrInvalidParams) OrigErr() error {
+	return awserr.NewBatchError(
+		InvalidParameterErrCode, e.Message(), e.OrigErrs())
+}
+
+// OrigErrs returns a slice of the invalid parameters
+func (e ErrInvalidParams) OrigErrs() []error {
+	errs := make([]error, len(e.errs))
+	for i := 0; i < len(errs); i++ {
+		errs[i] = e.errs[i]
+	}
+
+	return errs
+}
+
+// An ErrInvalidParam represents an invalid parameter error type.
+type ErrInvalidParam interface {
+	awserr.Error
+
+	// Field name the error occurred on.
+	Field() string
+
+	// SetContext updates the context of the error.
+	SetContext(string)
+
+	// AddNestedContext updates the error's context to include a nested level.
+	AddNestedContext(string)
+}
+
+type errInvalidParam struct {
+	context       string
+	nestedContext string
+	field         string
+	code          string
+	msg           string
+}
+
+// Code returns the error code for the type of invalid parameter.
+func (e *errInvalidParam) Code() string {
+	return e.code
+}
+
+// Message returns the reason the parameter was invalid, and its context.
+func (e *errInvalidParam) Message() string {
+	return fmt.Sprintf("%s, %s.", e.msg, e.Field())
+}
+
+// Error returns the string version of the invalid parameter error.
+func (e *errInvalidParam) Error() string {
+	return fmt.Sprintf("%s: %s", e.code, e.Message())
+}
+
+// OrigErr returns nil, Implemented for awserr.Error interface.
+func (e *errInvalidParam) OrigErr() error {
+	return nil
+}
+
+// Field Returns the field and context the error occurred.
+func (e *errInvalidParam) Field() string {
+	field := e.context
+	if len(field) > 0 {
+		field += "."
+	}
+	if len(e.nestedContext) > 0 {
+		field += fmt.Sprintf("%s.", e.nestedContext)
+	}
+	field += e.field
+
+	return field
+}
+
+// SetContext updates the base context of the error.
+func (e *errInvalidParam) SetContext(ctx string) {
+	e.context = ctx
+}
+
+// AddNestedContext prepends a context to the field's path.
+func (e *errInvalidParam) AddNestedContext(ctx string) {
+	if len(e.nestedContext) == 0 {
+		e.nestedContext = ctx
+	} else {
+		e.nestedContext = fmt.Sprintf("%s.%s", ctx, e.nestedContext)
+	}
+
+}
+
+// An ErrParamRequired represents an required parameter error.
+type ErrParamRequired struct {
+	errInvalidParam
+}
+
+// NewErrParamRequired creates a new required parameter error.
+func NewErrParamRequired(field string) *ErrParamRequired {
+	return &ErrParamRequired{
+		errInvalidParam{
+			code:  ParamRequiredErrCode,
+			field: field,
+			msg:   fmt.Sprintf("missing required field"),
+		},
+	}
+}
+
+// An ErrParamMinValue represents a minimum value parameter error.
+type ErrParamMinValue struct {
+	errInvalidParam
+	min float64
+}
+
+// NewErrParamMinValue creates a new minimum value parameter error.
+func NewErrParamMinValue(field string, min float64) *ErrParamMinValue {
+	return &ErrParamMinValue{
+		errInvalidParam: errInvalidParam{
+			code:  ParamMinValueErrCode,
+			field: field,
+			msg:   fmt.Sprintf("minimum field value of %v", min),
+		},
+		min: min,
+	}
+}
+
+// MinValue returns the field's require minimum value.
+//
+// float64 is returned for both int and float min values.
+func (e *ErrParamMinValue) MinValue() float64 {
+	return e.min
+}
+
+// An ErrParamMinLen represents a minimum length parameter error.
+type ErrParamMinLen struct {
+	errInvalidParam
+	min int
+}
+
+// NewErrParamMinLen creates a new minimum length parameter error.
+func NewErrParamMinLen(field string, min int) *ErrParamMinLen {
+	return &ErrParamMinLen{
+		errInvalidParam: errInvalidParam{
+			code:  ParamMinLenErrCode,
+			field: field,
+			msg:   fmt.Sprintf("minimum field size of %v", min),
+		},
+		min: min,
+	}
+}
+
+// MinLen returns the field's required minimum length.
+func (e *ErrParamMinLen) MinLen() int {
+	return e.min
+}
+
+// An ErrParamMaxLen represents a maximum length parameter error.
+type ErrParamMaxLen struct {
+	errInvalidParam
+	max int
+}
+
+// NewErrParamMaxLen creates a new maximum length parameter error.
+func NewErrParamMaxLen(field string, max int, value string) *ErrParamMaxLen {
+	return &ErrParamMaxLen{
+		errInvalidParam: errInvalidParam{
+			code:  ParamMaxLenErrCode,
+			field: field,
+			msg:   fmt.Sprintf("maximum size of %v, %v", max, value),
+		},
+		max: max,
+	}
+}
+
+// MaxLen returns the field's required minimum length.
+func (e *ErrParamMaxLen) MaxLen() int {
+	return e.max
+}
+
+// An ErrParamFormat represents a invalid format parameter error.
+type ErrParamFormat struct {
+	errInvalidParam
+	format string
+}
+
+// NewErrParamFormat creates a new invalid format parameter error.
+func NewErrParamFormat(field string, format, value string) *ErrParamFormat {
+	return &ErrParamFormat{
+		errInvalidParam: errInvalidParam{
+			code:  ParamFormatErrCode,
+			field: field,
+			msg:   fmt.Sprintf("format %v, %v", format, value),
+		},
+		format: format,
+	}
+}
+
+// Format returns the field's required format.
+func (e *ErrParamFormat) Format() string {
+	return e.format
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/waiter.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/waiter.go
new file mode 100644
index 00000000..4601f883
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/request/waiter.go
@@ -0,0 +1,295 @@
+package request
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/awsutil"
+)
+
+// WaiterResourceNotReadyErrorCode is the error code returned by a waiter when
+// the waiter's max attempts have been exhausted.
+const WaiterResourceNotReadyErrorCode = "ResourceNotReady"
+
+// A WaiterOption is a function that will update the Waiter value's fields to
+// configure the waiter.
+type WaiterOption func(*Waiter)
+
+// WithWaiterMaxAttempts returns the maximum number of times the waiter should
+// attempt to check the resource for the target state.
+func WithWaiterMaxAttempts(max int) WaiterOption {
+	return func(w *Waiter) {
+		w.MaxAttempts = max
+	}
+}
+
+// WaiterDelay will return a delay the waiter should pause between attempts to
+// check the resource state. The passed in attempt is the number of times the
+// Waiter has checked the resource state.
+//
+// Attempt is the number of attempts the Waiter has made checking the resource
+// state.
+type WaiterDelay func(attempt int) time.Duration
+
+// ConstantWaiterDelay returns a WaiterDelay that will always return a constant
+// delay the waiter should use between attempts. It ignores the number of
+// attempts made.
+func ConstantWaiterDelay(delay time.Duration) WaiterDelay {
+	return func(attempt int) time.Duration {
+		return delay
+	}
+}
+
+// WithWaiterDelay will set the Waiter to use the WaiterDelay passed in.
+func WithWaiterDelay(delayer WaiterDelay) WaiterOption {
+	return func(w *Waiter) {
+		w.Delay = delayer
+	}
+}
+
+// WithWaiterLogger returns a waiter option to set the logger a waiter
+// should use to log warnings and errors to.
+func WithWaiterLogger(logger aws.Logger) WaiterOption {
+	return func(w *Waiter) {
+		w.Logger = logger
+	}
+}
+
+// WithWaiterRequestOptions returns a waiter option setting the request
+// options for each request the waiter makes. Appends to waiter's request
+// options already set.
+func WithWaiterRequestOptions(opts ...Option) WaiterOption {
+	return func(w *Waiter) {
+		w.RequestOptions = append(w.RequestOptions, opts...)
+	}
+}
+
+// A Waiter provides the functionality to perform a blocking call which will
+// wait for a resource state to be satisfied by a service.
+//
+// This type should not be used directly. The API operations provided in the
+// service packages prefixed with "WaitUntil" should be used instead.
+type Waiter struct {
+	Name      string
+	Acceptors []WaiterAcceptor
+	Logger    aws.Logger
+
+	MaxAttempts int
+	Delay       WaiterDelay
+
+	RequestOptions   []Option
+	NewRequest       func([]Option) (*Request, error)
+	SleepWithContext func(aws.Context, time.Duration) error
+}
+
+// ApplyOptions updates the waiter with the list of waiter options provided.
+func (w *Waiter) ApplyOptions(opts ...WaiterOption) {
+	for _, fn := range opts {
+		fn(w)
+	}
+}
+
+// WaiterState are states the waiter uses based on WaiterAcceptor definitions
+// to identify if the resource state the waiter is waiting on has occurred.
+type WaiterState int
+
+// String returns the string representation of the waiter state.
+func (s WaiterState) String() string {
+	switch s {
+	case SuccessWaiterState:
+		return "success"
+	case FailureWaiterState:
+		return "failure"
+	case RetryWaiterState:
+		return "retry"
+	default:
+		return "unknown waiter state"
+	}
+}
+
+// States the waiter acceptors will use to identify target resource states.
+const (
+	SuccessWaiterState WaiterState = iota // waiter successful
+	FailureWaiterState                    // waiter failed
+	RetryWaiterState                      // waiter needs to be retried
+)
+
+// WaiterMatchMode is the mode that the waiter will use to match the WaiterAcceptor
+// definition's Expected attribute.
+type WaiterMatchMode int
+
+// Modes the waiter will use when inspecting API response to identify target
+// resource states.
+const (
+	PathAllWaiterMatch  WaiterMatchMode = iota // match on all paths
+	PathWaiterMatch                            // match on specific path
+	PathAnyWaiterMatch                         // match on any path
+	PathListWaiterMatch                        // match on list of paths
+	StatusWaiterMatch                          // match on status code
+	ErrorWaiterMatch                           // match on error
+)
+
+// String returns the string representation of the waiter match mode.
+func (m WaiterMatchMode) String() string {
+	switch m {
+	case PathAllWaiterMatch:
+		return "pathAll"
+	case PathWaiterMatch:
+		return "path"
+	case PathAnyWaiterMatch:
+		return "pathAny"
+	case PathListWaiterMatch:
+		return "pathList"
+	case StatusWaiterMatch:
+		return "status"
+	case ErrorWaiterMatch:
+		return "error"
+	default:
+		return "unknown waiter match mode"
+	}
+}
+
+// WaitWithContext will make requests for the API operation using NewRequest to
+// build API requests. The request's response will be compared against the
+// Waiter's Acceptors to determine the successful state of the resource the
+// waiter is inspecting.
+//
+// The passed in context must not be nil. If it is nil a panic will occur. The
+// Context will be used to cancel the waiter's pending requests and retry delays.
+// Use aws.BackgroundContext if no context is available.
+//
+// The waiter will continue until the target state defined by the Acceptors,
+// or the max attempts expires.
+//
+// Will return the WaiterResourceNotReadyErrorCode error code if the waiter's
+// retryer ShouldRetry returns false. This normally will happen when the max
+// wait attempts expires.
+func (w Waiter) WaitWithContext(ctx aws.Context) error {
+
+	for attempt := 1; ; attempt++ {
+		req, err := w.NewRequest(w.RequestOptions)
+		if err != nil {
+			waiterLogf(w.Logger, "unable to create request %v", err)
+			return err
+		}
+		req.Handlers.Build.PushBack(MakeAddToUserAgentFreeFormHandler("Waiter"))
+		err = req.Send()
+
+		// See if any of the acceptors match the request's response, or error
+		for _, a := range w.Acceptors {
+			if matched, matchErr := a.match(w.Name, w.Logger, req, err); matched {
+				return matchErr
+			}
+		}
+
+		// The Waiter should only check the resource state MaxAttempts times
+		// This is here instead of in the for loop above to prevent delaying
+		// unnecessary when the waiter will not retry.
+		if attempt == w.MaxAttempts {
+			break
+		}
+
+		// Delay to wait before inspecting the resource again
+		delay := w.Delay(attempt)
+		if sleepFn := req.Config.SleepDelay; sleepFn != nil {
+			// Support SleepDelay for backwards compatibility and testing
+			sleepFn(delay)
+		} else {
+			sleepCtxFn := w.SleepWithContext
+			if sleepCtxFn == nil {
+				sleepCtxFn = aws.SleepWithContext
+			}
+
+			if err := sleepCtxFn(ctx, delay); err != nil {
+				return awserr.New(CanceledErrorCode, "waiter context canceled", err)
+			}
+		}
+	}
+
+	return awserr.New(WaiterResourceNotReadyErrorCode, "exceeded wait attempts", nil)
+}
+
+// A WaiterAcceptor provides the information needed to wait for an API operation
+// to complete.
+type WaiterAcceptor struct {
+	State    WaiterState
+	Matcher  WaiterMatchMode
+	Argument string
+	Expected interface{}
+}
+
+// match returns if the acceptor found a match with the passed in request
+// or error. True is returned if the acceptor made a match, error is returned
+// if there was an error attempting to perform the match.
+func (a *WaiterAcceptor) match(name string, l aws.Logger, req *Request, err error) (bool, error) {
+	result := false
+	var vals []interface{}
+
+	switch a.Matcher {
+	case PathAllWaiterMatch, PathWaiterMatch:
+		// Require all matches to be equal for result to match
+		vals, _ = awsutil.ValuesAtPath(req.Data, a.Argument)
+		if len(vals) == 0 {
+			break
+		}
+		result = true
+		for _, val := range vals {
+			if !awsutil.DeepEqual(val, a.Expected) {
+				result = false
+				break
+			}
+		}
+	case PathAnyWaiterMatch:
+		// Only a single match needs to equal for the result to match
+		vals, _ = awsutil.ValuesAtPath(req.Data, a.Argument)
+		for _, val := range vals {
+			if awsutil.DeepEqual(val, a.Expected) {
+				result = true
+				break
+			}
+		}
+	case PathListWaiterMatch:
+		// ignored matcher
+	case StatusWaiterMatch:
+		s := a.Expected.(int)
+		result = s == req.HTTPResponse.StatusCode
+	case ErrorWaiterMatch:
+		if aerr, ok := err.(awserr.Error); ok {
+			result = aerr.Code() == a.Expected.(string)
+		}
+	default:
+		waiterLogf(l, "WARNING: Waiter %s encountered unexpected matcher: %s",
+			name, a.Matcher)
+	}
+
+	if !result {
+		// If there was no matching result found there is nothing more to do
+		// for this response, retry the request.
+		return false, nil
+	}
+
+	switch a.State {
+	case SuccessWaiterState:
+		// waiter completed
+		return true, nil
+	case FailureWaiterState:
+		// Waiter failure state triggered
+		return true, awserr.New(WaiterResourceNotReadyErrorCode,
+			"failed waiting for successful resource state", err)
+	case RetryWaiterState:
+		// clear the error and retry the operation
+		return false, nil
+	default:
+		waiterLogf(l, "WARNING: Waiter %s encountered unexpected state: %s",
+			name, a.State)
+		return false, nil
+	}
+}
+
+func waiterLogf(logger aws.Logger, msg string, args ...interface{}) {
+	if logger != nil {
+		logger.Log(fmt.Sprintf(msg, args...))
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/types.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/types.go
new file mode 100644
index 00000000..8b6f2342
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/types.go
@@ -0,0 +1,201 @@
+package aws
+
+import (
+	"io"
+	"sync"
+
+	"github.com/aws/aws-sdk-go/internal/sdkio"
+)
+
+// ReadSeekCloser wraps a io.Reader returning a ReaderSeekerCloser. Should
+// only be used with an io.Reader that is also an io.Seeker. Doing so may
+// cause request signature errors, or request body's not sent for GET, HEAD
+// and DELETE HTTP methods.
+//
+// Deprecated: Should only be used with io.ReadSeeker. If using for
+// S3 PutObject to stream content use s3manager.Uploader instead.
+func ReadSeekCloser(r io.Reader) ReaderSeekerCloser {
+	return ReaderSeekerCloser{r}
+}
+
+// ReaderSeekerCloser represents a reader that can also delegate io.Seeker and
+// io.Closer interfaces to the underlying object if they are available.
+type ReaderSeekerCloser struct {
+	r io.Reader
+}
+
+// IsReaderSeekable returns if the underlying reader type can be seeked. A
+// io.Reader might not actually be seekable if it is the ReaderSeekerCloser
+// type.
+func IsReaderSeekable(r io.Reader) bool {
+	switch v := r.(type) {
+	case ReaderSeekerCloser:
+		return v.IsSeeker()
+	case *ReaderSeekerCloser:
+		return v.IsSeeker()
+	case io.ReadSeeker:
+		return true
+	default:
+		return false
+	}
+}
+
+// Read reads from the reader up to size of p. The number of bytes read, and
+// error if it occurred will be returned.
+//
+// If the reader is not an io.Reader zero bytes read, and nil error will be returned.
+//
+// Performs the same functionality as io.Reader Read
+func (r ReaderSeekerCloser) Read(p []byte) (int, error) {
+	switch t := r.r.(type) {
+	case io.Reader:
+		return t.Read(p)
+	}
+	return 0, nil
+}
+
+// Seek sets the offset for the next Read to offset, interpreted according to
+// whence: 0 means relative to the origin of the file, 1 means relative to the
+// current offset, and 2 means relative to the end. Seek returns the new offset
+// and an error, if any.
+//
+// If the ReaderSeekerCloser is not an io.Seeker nothing will be done.
+func (r ReaderSeekerCloser) Seek(offset int64, whence int) (int64, error) {
+	switch t := r.r.(type) {
+	case io.Seeker:
+		return t.Seek(offset, whence)
+	}
+	return int64(0), nil
+}
+
+// IsSeeker returns if the underlying reader is also a seeker.
+func (r ReaderSeekerCloser) IsSeeker() bool {
+	_, ok := r.r.(io.Seeker)
+	return ok
+}
+
+// HasLen returns the length of the underlying reader if the value implements
+// the Len() int method.
+func (r ReaderSeekerCloser) HasLen() (int, bool) {
+	type lenner interface {
+		Len() int
+	}
+
+	if lr, ok := r.r.(lenner); ok {
+		return lr.Len(), true
+	}
+
+	return 0, false
+}
+
+// GetLen returns the length of the bytes remaining in the underlying reader.
+// Checks first for Len(), then io.Seeker to determine the size of the
+// underlying reader.
+//
+// Will return -1 if the length cannot be determined.
+func (r ReaderSeekerCloser) GetLen() (int64, error) {
+	if l, ok := r.HasLen(); ok {
+		return int64(l), nil
+	}
+
+	if s, ok := r.r.(io.Seeker); ok {
+		return seekerLen(s)
+	}
+
+	return -1, nil
+}
+
+// SeekerLen attempts to get the number of bytes remaining at the seeker's
+// current position.  Returns the number of bytes remaining or error.
+func SeekerLen(s io.Seeker) (int64, error) {
+	// Determine if the seeker is actually seekable. ReaderSeekerCloser
+	// hides the fact that a io.Readers might not actually be seekable.
+	switch v := s.(type) {
+	case ReaderSeekerCloser:
+		return v.GetLen()
+	case *ReaderSeekerCloser:
+		return v.GetLen()
+	}
+
+	return seekerLen(s)
+}
+
+func seekerLen(s io.Seeker) (int64, error) {
+	curOffset, err := s.Seek(0, sdkio.SeekCurrent)
+	if err != nil {
+		return 0, err
+	}
+
+	endOffset, err := s.Seek(0, sdkio.SeekEnd)
+	if err != nil {
+		return 0, err
+	}
+
+	_, err = s.Seek(curOffset, sdkio.SeekStart)
+	if err != nil {
+		return 0, err
+	}
+
+	return endOffset - curOffset, nil
+}
+
+// Close closes the ReaderSeekerCloser.
+//
+// If the ReaderSeekerCloser is not an io.Closer nothing will be done.
+func (r ReaderSeekerCloser) Close() error {
+	switch t := r.r.(type) {
+	case io.Closer:
+		return t.Close()
+	}
+	return nil
+}
+
+// A WriteAtBuffer provides a in memory buffer supporting the io.WriterAt interface
+// Can be used with the s3manager.Downloader to download content to a buffer
+// in memory. Safe to use concurrently.
+type WriteAtBuffer struct {
+	buf []byte
+	m   sync.Mutex
+
+	// GrowthCoeff defines the growth rate of the internal buffer. By
+	// default, the growth rate is 1, where expanding the internal
+	// buffer will allocate only enough capacity to fit the new expected
+	// length.
+	GrowthCoeff float64
+}
+
+// NewWriteAtBuffer creates a WriteAtBuffer with an internal buffer
+// provided by buf.
+func NewWriteAtBuffer(buf []byte) *WriteAtBuffer {
+	return &WriteAtBuffer{buf: buf}
+}
+
+// WriteAt writes a slice of bytes to a buffer starting at the position provided
+// The number of bytes written will be returned, or error. Can overwrite previous
+// written slices if the write ats overlap.
+func (b *WriteAtBuffer) WriteAt(p []byte, pos int64) (n int, err error) {
+	pLen := len(p)
+	expLen := pos + int64(pLen)
+	b.m.Lock()
+	defer b.m.Unlock()
+	if int64(len(b.buf)) < expLen {
+		if int64(cap(b.buf)) < expLen {
+			if b.GrowthCoeff < 1 {
+				b.GrowthCoeff = 1
+			}
+			newBuf := make([]byte, expLen, int64(b.GrowthCoeff*float64(expLen)))
+			copy(newBuf, b.buf)
+			b.buf = newBuf
+		}
+		b.buf = b.buf[:expLen]
+	}
+	copy(b.buf[pos:], p)
+	return pLen, nil
+}
+
+// Bytes returns a slice of bytes written to the buffer.
+func (b *WriteAtBuffer) Bytes() []byte {
+	b.m.Lock()
+	defer b.m.Unlock()
+	return b.buf
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/url.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/url.go
new file mode 100644
index 00000000..6192b245
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/url.go
@@ -0,0 +1,12 @@
+// +build go1.8
+
+package aws
+
+import "net/url"
+
+// URLHostname will extract the Hostname without port from the URL value.
+//
+// Wrapper of net/url#URL.Hostname for backwards Go version compatibility.
+func URLHostname(url *url.URL) string {
+	return url.Hostname()
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/url_1_7.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/url_1_7.go
new file mode 100644
index 00000000..0210d272
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/url_1_7.go
@@ -0,0 +1,29 @@
+// +build !go1.8
+
+package aws
+
+import (
+	"net/url"
+	"strings"
+)
+
+// URLHostname will extract the Hostname without port from the URL value.
+//
+// Copy of Go 1.8's net/url#URL.Hostname functionality.
+func URLHostname(url *url.URL) string {
+	return stripPort(url.Host)
+
+}
+
+// stripPort is copy of Go 1.8 url#URL.Hostname functionality.
+// https://golang.org/src/net/url/url.go
+func stripPort(hostport string) string {
+	colon := strings.IndexByte(hostport, ':')
+	if colon == -1 {
+		return hostport
+	}
+	if i := strings.IndexByte(hostport, ']'); i != -1 {
+		return strings.TrimPrefix(hostport[:i], "[")
+	}
+	return hostport[:colon]
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/version.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/version.go
new file mode 100644
index 00000000..b3644a1e
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/aws/version.go
@@ -0,0 +1,8 @@
+// Package aws provides core functionality for making requests to AWS services.
+package aws
+
+// SDKName is the name of this AWS SDK
+const SDKName = "aws-sdk-go"
+
+// SDKVersion is the version of this SDK
+const SDKVersion = "1.19.0"
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/ast.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/ast.go
new file mode 100644
index 00000000..e83a9988
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/ast.go
@@ -0,0 +1,120 @@
+package ini
+
+// ASTKind represents different states in the parse table
+// and the type of AST that is being constructed
+type ASTKind int
+
+// ASTKind* is used in the parse table to transition between
+// the different states
+const (
+	ASTKindNone = ASTKind(iota)
+	ASTKindStart
+	ASTKindExpr
+	ASTKindEqualExpr
+	ASTKindStatement
+	ASTKindSkipStatement
+	ASTKindExprStatement
+	ASTKindSectionStatement
+	ASTKindNestedSectionStatement
+	ASTKindCompletedNestedSectionStatement
+	ASTKindCommentStatement
+	ASTKindCompletedSectionStatement
+)
+
+func (k ASTKind) String() string {
+	switch k {
+	case ASTKindNone:
+		return "none"
+	case ASTKindStart:
+		return "start"
+	case ASTKindExpr:
+		return "expr"
+	case ASTKindStatement:
+		return "stmt"
+	case ASTKindSectionStatement:
+		return "section_stmt"
+	case ASTKindExprStatement:
+		return "expr_stmt"
+	case ASTKindCommentStatement:
+		return "comment"
+	case ASTKindNestedSectionStatement:
+		return "nested_section_stmt"
+	case ASTKindCompletedSectionStatement:
+		return "completed_stmt"
+	case ASTKindSkipStatement:
+		return "skip"
+	default:
+		return ""
+	}
+}
+
+// AST interface allows us to determine what kind of node we
+// are on and casting may not need to be necessary.
+//
+// The root is always the first node in Children
+type AST struct {
+	Kind      ASTKind
+	Root      Token
+	RootToken bool
+	Children  []AST
+}
+
+func newAST(kind ASTKind, root AST, children ...AST) AST {
+	return AST{
+		Kind:     kind,
+		Children: append([]AST{root}, children...),
+	}
+}
+
+func newASTWithRootToken(kind ASTKind, root Token, children ...AST) AST {
+	return AST{
+		Kind:      kind,
+		Root:      root,
+		RootToken: true,
+		Children:  children,
+	}
+}
+
+// AppendChild will append to the list of children an AST has.
+func (a *AST) AppendChild(child AST) {
+	a.Children = append(a.Children, child)
+}
+
+// GetRoot will return the root AST which can be the first entry
+// in the children list or a token.
+func (a *AST) GetRoot() AST {
+	if a.RootToken {
+		return *a
+	}
+
+	if len(a.Children) == 0 {
+		return AST{}
+	}
+
+	return a.Children[0]
+}
+
+// GetChildren will return the current AST's list of children
+func (a *AST) GetChildren() []AST {
+	if len(a.Children) == 0 {
+		return []AST{}
+	}
+
+	if a.RootToken {
+		return a.Children
+	}
+
+	return a.Children[1:]
+}
+
+// SetChildren will set and override all children of the AST.
+func (a *AST) SetChildren(children []AST) {
+	if a.RootToken {
+		a.Children = children
+	} else {
+		a.Children = append(a.Children[:1], children...)
+	}
+}
+
+// Start is used to indicate the starting state of the parse table.
+var Start = newAST(ASTKindStart, AST{})
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/comma_token.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/comma_token.go
new file mode 100644
index 00000000..0895d53c
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/comma_token.go
@@ -0,0 +1,11 @@
+package ini
+
+var commaRunes = []rune(",")
+
+func isComma(b rune) bool {
+	return b == ','
+}
+
+func newCommaToken() Token {
+	return newToken(TokenComma, commaRunes, NoneType)
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/comment_token.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/comment_token.go
new file mode 100644
index 00000000..0b76999b
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/comment_token.go
@@ -0,0 +1,35 @@
+package ini
+
+// isComment will return whether or not the next byte(s) is a
+// comment.
+func isComment(b []rune) bool {
+	if len(b) == 0 {
+		return false
+	}
+
+	switch b[0] {
+	case ';':
+		return true
+	case '#':
+		return true
+	}
+
+	return false
+}
+
+// newCommentToken will create a comment token and
+// return how many bytes were read.
+func newCommentToken(b []rune) (Token, int, error) {
+	i := 0
+	for ; i < len(b); i++ {
+		if b[i] == '\n' {
+			break
+		}
+
+		if len(b)-i > 2 && b[i] == '\r' && b[i+1] == '\n' {
+			break
+		}
+	}
+
+	return newToken(TokenComment, b[:i], NoneType), i, nil
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/doc.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/doc.go
new file mode 100644
index 00000000..25ce0fe1
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/doc.go
@@ -0,0 +1,29 @@
+// Package ini is an LL(1) parser for configuration files.
+//
+//	Example:
+//	sections, err := ini.OpenFile("/path/to/file")
+//	if err != nil {
+//		panic(err)
+//	}
+//
+//	profile := "foo"
+//	section, ok := sections.GetSection(profile)
+//	if !ok {
+//		fmt.Printf("section %q could not be found", profile)
+//	}
+//
+// Below is the BNF that describes this parser
+//	Grammar:
+//	stmt -> value stmt'
+//	stmt' -> epsilon | op stmt
+//	value -> number | string | boolean | quoted_string
+//
+//	section -> [ section'
+//	section' -> value section_close
+//	section_close -> ]
+//
+//	SkipState will skip (NL WS)+
+//
+//	comment -> # comment' | ; comment'
+//	comment' -> epsilon | value
+package ini
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/empty_token.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/empty_token.go
new file mode 100644
index 00000000..04345a54
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/empty_token.go
@@ -0,0 +1,4 @@
+package ini
+
+// emptyToken is used to satisfy the Token interface
+var emptyToken = newToken(TokenNone, []rune{}, NoneType)
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/expression.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/expression.go
new file mode 100644
index 00000000..91ba2a59
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/expression.go
@@ -0,0 +1,24 @@
+package ini
+
+// newExpression will return an expression AST.
+// Expr represents an expression
+//
+//	grammar:
+//	expr -> string | number
+func newExpression(tok Token) AST {
+	return newASTWithRootToken(ASTKindExpr, tok)
+}
+
+func newEqualExpr(left AST, tok Token) AST {
+	return newASTWithRootToken(ASTKindEqualExpr, tok, left)
+}
+
+// EqualExprKey will return a LHS value in the equal expr
+func EqualExprKey(ast AST) string {
+	children := ast.GetChildren()
+	if len(children) == 0 || ast.Kind != ASTKindEqualExpr {
+		return ""
+	}
+
+	return string(children[0].Root.Raw())
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/fuzz.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/fuzz.go
new file mode 100644
index 00000000..8d462f77
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/fuzz.go
@@ -0,0 +1,17 @@
+// +build gofuzz
+
+package ini
+
+import (
+	"bytes"
+)
+
+func Fuzz(data []byte) int {
+	b := bytes.NewReader(data)
+
+	if _, err := Parse(b); err != nil {
+		return 0
+	}
+
+	return 1
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/ini.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/ini.go
new file mode 100644
index 00000000..3b0ca7af
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/ini.go
@@ -0,0 +1,51 @@
+package ini
+
+import (
+	"io"
+	"os"
+
+	"github.com/aws/aws-sdk-go/aws/awserr"
+)
+
+// OpenFile takes a path to a given file, and will open  and parse
+// that file.
+func OpenFile(path string) (Sections, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return Sections{}, awserr.New(ErrCodeUnableToReadFile, "unable to open file", err)
+	}
+	defer f.Close()
+
+	return Parse(f)
+}
+
+// Parse will parse the given file using the shared config
+// visitor.
+func Parse(f io.Reader) (Sections, error) {
+	tree, err := ParseAST(f)
+	if err != nil {
+		return Sections{}, err
+	}
+
+	v := NewDefaultVisitor()
+	if err = Walk(tree, v); err != nil {
+		return Sections{}, err
+	}
+
+	return v.Sections, nil
+}
+
+// ParseBytes will parse the given bytes and return the parsed sections.
+func ParseBytes(b []byte) (Sections, error) {
+	tree, err := ParseASTBytes(b)
+	if err != nil {
+		return Sections{}, err
+	}
+
+	v := NewDefaultVisitor()
+	if err = Walk(tree, v); err != nil {
+		return Sections{}, err
+	}
+
+	return v.Sections, nil
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/ini_lexer.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/ini_lexer.go
new file mode 100644
index 00000000..582c024a
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/ini_lexer.go
@@ -0,0 +1,165 @@
+package ini
+
+import (
+	"bytes"
+	"io"
+	"io/ioutil"
+
+	"github.com/aws/aws-sdk-go/aws/awserr"
+)
+
+const (
+	// ErrCodeUnableToReadFile is used when a file is failed to be
+	// opened or read from.
+	ErrCodeUnableToReadFile = "FailedRead"
+)
+
+// TokenType represents the various different tokens types
+type TokenType int
+
+func (t TokenType) String() string {
+	switch t {
+	case TokenNone:
+		return "none"
+	case TokenLit:
+		return "literal"
+	case TokenSep:
+		return "sep"
+	case TokenOp:
+		return "op"
+	case TokenWS:
+		return "ws"
+	case TokenNL:
+		return "newline"
+	case TokenComment:
+		return "comment"
+	case TokenComma:
+		return "comma"
+	default:
+		return ""
+	}
+}
+
+// TokenType enums
+const (
+	TokenNone = TokenType(iota)
+	TokenLit
+	TokenSep
+	TokenComma
+	TokenOp
+	TokenWS
+	TokenNL
+	TokenComment
+)
+
+type iniLexer struct{}
+
+// Tokenize will return a list of tokens during lexical analysis of the
+// io.Reader.
+func (l *iniLexer) Tokenize(r io.Reader) ([]Token, error) {
+	b, err := ioutil.ReadAll(r)
+	if err != nil {
+		return nil, awserr.New(ErrCodeUnableToReadFile, "unable to read file", err)
+	}
+
+	return l.tokenize(b)
+}
+
+func (l *iniLexer) tokenize(b []byte) ([]Token, error) {
+	runes := bytes.Runes(b)
+	var err error
+	n := 0
+	tokenAmount := countTokens(runes)
+	tokens := make([]Token, tokenAmount)
+	count := 0
+
+	for len(runes) > 0 && count < tokenAmount {
+		switch {
+		case isWhitespace(runes[0]):
+			tokens[count], n, err = newWSToken(runes)
+		case isComma(runes[0]):
+			tokens[count], n = newCommaToken(), 1
+		case isComment(runes):
+			tokens[count], n, err = newCommentToken(runes)
+		case isNewline(runes):
+			tokens[count], n, err = newNewlineToken(runes)
+		case isSep(runes):
+			tokens[count], n, err = newSepToken(runes)
+		case isOp(runes):
+			tokens[count], n, err = newOpToken(runes)
+		default:
+			tokens[count], n, err = newLitToken(runes)
+		}
+
+		if err != nil {
+			return nil, err
+		}
+
+		count++
+
+		runes = runes[n:]
+	}
+
+	return tokens[:count], nil
+}
+
+func countTokens(runes []rune) int {
+	count, n := 0, 0
+	var err error
+
+	for len(runes) > 0 {
+		switch {
+		case isWhitespace(runes[0]):
+			_, n, err = newWSToken(runes)
+		case isComma(runes[0]):
+			_, n = newCommaToken(), 1
+		case isComment(runes):
+			_, n, err = newCommentToken(runes)
+		case isNewline(runes):
+			_, n, err = newNewlineToken(runes)
+		case isSep(runes):
+			_, n, err = newSepToken(runes)
+		case isOp(runes):
+			_, n, err = newOpToken(runes)
+		default:
+			_, n, err = newLitToken(runes)
+		}
+
+		if err != nil {
+			return 0
+		}
+
+		count++
+		runes = runes[n:]
+	}
+
+	return count + 1
+}
+
+// Token indicates a metadata about a given value.
+type Token struct {
+	t         TokenType
+	ValueType ValueType
+	base      int
+	raw       []rune
+}
+
+var emptyValue = Value{}
+
+func newToken(t TokenType, raw []rune, v ValueType) Token {
+	return Token{
+		t:         t,
+		raw:       raw,
+		ValueType: v,
+	}
+}
+
+// Raw return the raw runes that were consumed
+func (tok Token) Raw() []rune {
+	return tok.raw
+}
+
+// Type returns the token type
+func (tok Token) Type() TokenType {
+	return tok.t
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/ini_parser.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/ini_parser.go
new file mode 100644
index 00000000..f9970337
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/ini_parser.go
@@ -0,0 +1,347 @@
+package ini
+
+import (
+	"fmt"
+	"io"
+)
+
+// State enums for the parse table
+const (
+	InvalidState = iota
+	// stmt -> value stmt'
+	StatementState
+	// stmt' -> MarkComplete | op stmt
+	StatementPrimeState
+	// value -> number | string | boolean | quoted_string
+	ValueState
+	// section -> [ section'
+	OpenScopeState
+	// section' -> value section_close
+	SectionState
+	// section_close -> ]
+	CloseScopeState
+	// SkipState will skip (NL WS)+
+	SkipState
+	// SkipTokenState will skip any token and push the previous
+	// state onto the stack.
+	SkipTokenState
+	// comment -> # comment' | ; comment'
+	// comment' -> MarkComplete | value
+	CommentState
+	// MarkComplete state will complete statements and move that
+	// to the completed AST list
+	MarkCompleteState
+	// TerminalState signifies that the tokens have been fully parsed
+	TerminalState
+)
+
+// parseTable is a state machine to dictate the grammar above.
+var parseTable = map[ASTKind]map[TokenType]int{
+	ASTKindStart: map[TokenType]int{
+		TokenLit:     StatementState,
+		TokenSep:     OpenScopeState,
+		TokenWS:      SkipTokenState,
+		TokenNL:      SkipTokenState,
+		TokenComment: CommentState,
+		TokenNone:    TerminalState,
+	},
+	ASTKindCommentStatement: map[TokenType]int{
+		TokenLit:     StatementState,
+		TokenSep:     OpenScopeState,
+		TokenWS:      SkipTokenState,
+		TokenNL:      SkipTokenState,
+		TokenComment: CommentState,
+		TokenNone:    MarkCompleteState,
+	},
+	ASTKindExpr: map[TokenType]int{
+		TokenOp:      StatementPrimeState,
+		TokenLit:     ValueState,
+		TokenSep:     OpenScopeState,
+		TokenWS:      ValueState,
+		TokenNL:      SkipState,
+		TokenComment: CommentState,
+		TokenNone:    MarkCompleteState,
+	},
+	ASTKindEqualExpr: map[TokenType]int{
+		TokenLit: ValueState,
+		TokenWS:  SkipTokenState,
+		TokenNL:  SkipState,
+	},
+	ASTKindStatement: map[TokenType]int{
+		TokenLit:     SectionState,
+		TokenSep:     CloseScopeState,
+		TokenWS:      SkipTokenState,
+		TokenNL:      SkipTokenState,
+		TokenComment: CommentState,
+		TokenNone:    MarkCompleteState,
+	},
+	ASTKindExprStatement: map[TokenType]int{
+		TokenLit:     ValueState,
+		TokenSep:     OpenScopeState,
+		TokenOp:      ValueState,
+		TokenWS:      ValueState,
+		TokenNL:      MarkCompleteState,
+		TokenComment: CommentState,
+		TokenNone:    TerminalState,
+		TokenComma:   SkipState,
+	},
+	ASTKindSectionStatement: map[TokenType]int{
+		TokenLit: SectionState,
+		TokenOp:  SectionState,
+		TokenSep: CloseScopeState,
+		TokenWS:  SectionState,
+		TokenNL:  SkipTokenState,
+	},
+	ASTKindCompletedSectionStatement: map[TokenType]int{
+		TokenWS:      SkipTokenState,
+		TokenNL:      SkipTokenState,
+		TokenLit:     StatementState,
+		TokenSep:     OpenScopeState,
+		TokenComment: CommentState,
+		TokenNone:    MarkCompleteState,
+	},
+	ASTKindSkipStatement: map[TokenType]int{
+		TokenLit:     StatementState,
+		TokenSep:     OpenScopeState,
+		TokenWS:      SkipTokenState,
+		TokenNL:      SkipTokenState,
+		TokenComment: CommentState,
+		TokenNone:    TerminalState,
+	},
+}
+
+// ParseAST will parse input from an io.Reader using
+// an LL(1) parser.
+func ParseAST(r io.Reader) ([]AST, error) {
+	lexer := iniLexer{}
+	tokens, err := lexer.Tokenize(r)
+	if err != nil {
+		return []AST{}, err
+	}
+
+	return parse(tokens)
+}
+
+// ParseASTBytes will parse input from a byte slice using
+// an LL(1) parser.
+func ParseASTBytes(b []byte) ([]AST, error) {
+	lexer := iniLexer{}
+	tokens, err := lexer.tokenize(b)
+	if err != nil {
+		return []AST{}, err
+	}
+
+	return parse(tokens)
+}
+
+func parse(tokens []Token) ([]AST, error) {
+	start := Start
+	stack := newParseStack(3, len(tokens))
+
+	stack.Push(start)
+	s := newSkipper()
+
+loop:
+	for stack.Len() > 0 {
+		k := stack.Pop()
+
+		var tok Token
+		if len(tokens) == 0 {
+			// this occurs when all the tokens have been processed
+			// but reduction of what's left on the stack needs to
+			// occur.
+			tok = emptyToken
+		} else {
+			tok = tokens[0]
+		}
+
+		step := parseTable[k.Kind][tok.Type()]
+		if s.ShouldSkip(tok) {
+			// being in a skip state with no tokens will break out of
+			// the parse loop since there is nothing left to process.
+			if len(tokens) == 0 {
+				break loop
+			}
+
+			step = SkipTokenState
+		}
+
+		switch step {
+		case TerminalState:
+			// Finished parsing. Push what should be the last
+			// statement to the stack. If there is anything left
+			// on the stack, an error in parsing has occurred.
+			if k.Kind != ASTKindStart {
+				stack.MarkComplete(k)
+			}
+			break loop
+		case SkipTokenState:
+			// When skipping a token, the previous state was popped off the stack.
+			// To maintain the correct state, the previous state will be pushed
+			// onto the stack.
+			stack.Push(k)
+		case StatementState:
+			if k.Kind != ASTKindStart {
+				stack.MarkComplete(k)
+			}
+			expr := newExpression(tok)
+			stack.Push(expr)
+		case StatementPrimeState:
+			if tok.Type() != TokenOp {
+				stack.MarkComplete(k)
+				continue
+			}
+
+			if k.Kind != ASTKindExpr {
+				return nil, NewParseError(
+					fmt.Sprintf("invalid expression: expected Expr type, but found %T type", k),
+				)
+			}
+
+			k = trimSpaces(k)
+			expr := newEqualExpr(k, tok)
+			stack.Push(expr)
+		case ValueState:
+			// ValueState requires the previous state to either be an equal expression
+			// or an expression statement.
+			//
+			// This grammar occurs when the RHS is a number, word, or quoted string.
+			// equal_expr -> lit op equal_expr'
+			// equal_expr' -> number | string | quoted_string
+			// quoted_string -> " quoted_string'
+			// quoted_string' -> string quoted_string_end
+			// quoted_string_end -> "
+			//
+			// otherwise
+			// expr_stmt -> equal_expr (expr_stmt')*
+			// expr_stmt' -> ws S | op S | MarkComplete
+			// S -> equal_expr' expr_stmt'
+			switch k.Kind {
+			case ASTKindEqualExpr:
+				// assiging a value to some key
+				k.AppendChild(newExpression(tok))
+				stack.Push(newExprStatement(k))
+			case ASTKindExpr:
+				k.Root.raw = append(k.Root.raw, tok.Raw()...)
+				stack.Push(k)
+			case ASTKindExprStatement:
+				root := k.GetRoot()
+				children := root.GetChildren()
+				if len(children) == 0 {
+					return nil, NewParseError(
+						fmt.Sprintf("invalid expression: AST contains no children %s", k.Kind),
+					)
+				}
+
+				rhs := children[len(children)-1]
+
+				if rhs.Root.ValueType != QuotedStringType {
+					rhs.Root.ValueType = StringType
+					rhs.Root.raw = append(rhs.Root.raw, tok.Raw()...)
+
+				}
+
+				children[len(children)-1] = rhs
+				k.SetChildren(children)
+
+				stack.Push(k)
+			}
+		case OpenScopeState:
+			if !runeCompare(tok.Raw(), openBrace) {
+				return nil, NewParseError("expected '['")
+			}
+
+			stmt := newStatement()
+			stack.Push(stmt)
+		case CloseScopeState:
+			if !runeCompare(tok.Raw(), closeBrace) {
+				return nil, NewParseError("expected ']'")
+			}
+
+			k = trimSpaces(k)
+			stack.Push(newCompletedSectionStatement(k))
+		case SectionState:
+			var stmt AST
+
+			switch k.Kind {
+			case ASTKindStatement:
+				// If there are multiple literals inside of a scope declaration,
+				// then the current token's raw value will be appended to the Name.
+				//
+				// This handles cases like [ profile default ]
+				//
+				// k will represent a SectionStatement with the children representing
+				// the label of the section
+				stmt = newSectionStatement(tok)
+			case ASTKindSectionStatement:
+				k.Root.raw = append(k.Root.raw, tok.Raw()...)
+				stmt = k
+			default:
+				return nil, NewParseError(
+					fmt.Sprintf("invalid statement: expected statement: %v", k.Kind),
+				)
+			}
+
+			stack.Push(stmt)
+		case MarkCompleteState:
+			if k.Kind != ASTKindStart {
+				stack.MarkComplete(k)
+			}
+
+			if stack.Len() == 0 {
+				stack.Push(start)
+			}
+		case SkipState:
+			stack.Push(newSkipStatement(k))
+			s.Skip()
+		case CommentState:
+			if k.Kind == ASTKindStart {
+				stack.Push(k)
+			} else {
+				stack.MarkComplete(k)
+			}
+
+			stmt := newCommentStatement(tok)
+			stack.Push(stmt)
+		default:
+			return nil, NewParseError(fmt.Sprintf("invalid state with ASTKind %v and TokenType %v", k, tok))
+		}
+
+		if len(tokens) > 0 {
+			tokens = tokens[1:]
+		}
+	}
+
+	// this occurs when a statement has not been completed
+	if stack.top > 1 {
+		return nil, NewParseError(fmt.Sprintf("incomplete expression: %v", stack.container))
+	}
+
+	// returns a sublist which excludes the start symbol
+	return stack.List(), nil
+}
+
+// trimSpaces will trim spaces on the left and right hand side of
+// the literal.
+func trimSpaces(k AST) AST {
+	// trim left hand side of spaces
+	for i := 0; i < len(k.Root.raw); i++ {
+		if !isWhitespace(k.Root.raw[i]) {
+			break
+		}
+
+		k.Root.raw = k.Root.raw[1:]
+		i--
+	}
+
+	// trim right hand side of spaces
+	for i := len(k.Root.raw) - 1; i >= 0; i-- {
+		if !isWhitespace(k.Root.raw[i]) {
+			break
+		}
+
+		k.Root.raw = k.Root.raw[:len(k.Root.raw)-1]
+	}
+
+	return k
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/literal_tokens.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/literal_tokens.go
new file mode 100644
index 00000000..24df543d
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/literal_tokens.go
@@ -0,0 +1,324 @@
+package ini
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+var (
+	runesTrue  = []rune("true")
+	runesFalse = []rune("false")
+)
+
+var literalValues = [][]rune{
+	runesTrue,
+	runesFalse,
+}
+
+func isBoolValue(b []rune) bool {
+	for _, lv := range literalValues {
+		if isLitValue(lv, b) {
+			return true
+		}
+	}
+	return false
+}
+
+func isLitValue(want, have []rune) bool {
+	if len(have) < len(want) {
+		return false
+	}
+
+	for i := 0; i < len(want); i++ {
+		if want[i] != have[i] {
+			return false
+		}
+	}
+
+	return true
+}
+
+// isNumberValue will return whether not the leading characters in
+// a byte slice is a number. A number is delimited by whitespace or
+// the newline token.
+//
+// A number is defined to be in a binary, octal, decimal (int | float), hex format,
+// or in scientific notation.
+func isNumberValue(b []rune) bool {
+	negativeIndex := 0
+	helper := numberHelper{}
+	needDigit := false
+
+	for i := 0; i < len(b); i++ {
+		negativeIndex++
+
+		switch b[i] {
+		case '-':
+			if helper.IsNegative() || negativeIndex != 1 {
+				return false
+			}
+			helper.Determine(b[i])
+			needDigit = true
+			continue
+		case 'e', 'E':
+			if err := helper.Determine(b[i]); err != nil {
+				return false
+			}
+			negativeIndex = 0
+			needDigit = true
+			continue
+		case 'b':
+			if helper.numberFormat == hex {
+				break
+			}
+			fallthrough
+		case 'o', 'x':
+			needDigit = true
+			if i == 0 {
+				return false
+			}
+
+			fallthrough
+		case '.':
+			if err := helper.Determine(b[i]); err != nil {
+				return false
+			}
+			needDigit = true
+			continue
+		}
+
+		if i > 0 && (isNewline(b[i:]) || isWhitespace(b[i])) {
+			return !needDigit
+		}
+
+		if !helper.CorrectByte(b[i]) {
+			return false
+		}
+		needDigit = false
+	}
+
+	return !needDigit
+}
+
+func isValid(b []rune) (bool, int, error) {
+	if len(b) == 0 {
+		// TODO: should probably return an error
+		return false, 0, nil
+	}
+
+	return isValidRune(b[0]), 1, nil
+}
+
+func isValidRune(r rune) bool {
+	return r != ':' && r != '=' && r != '[' && r != ']' && r != ' ' && r != '\n'
+}
+
+// ValueType is an enum that will signify what type
+// the Value is
+type ValueType int
+
+func (v ValueType) String() string {
+	switch v {
+	case NoneType:
+		return "NONE"
+	case DecimalType:
+		return "FLOAT"
+	case IntegerType:
+		return "INT"
+	case StringType:
+		return "STRING"
+	case BoolType:
+		return "BOOL"
+	}
+
+	return ""
+}
+
+// ValueType enums
+const (
+	NoneType = ValueType(iota)
+	DecimalType
+	IntegerType
+	StringType
+	QuotedStringType
+	BoolType
+)
+
+// Value is a union container
+type Value struct {
+	Type ValueType
+	raw  []rune
+
+	integer int64
+	decimal float64
+	boolean bool
+	str     string
+}
+
+func newValue(t ValueType, base int, raw []rune) (Value, error) {
+	v := Value{
+		Type: t,
+		raw:  raw,
+	}
+	var err error
+
+	switch t {
+	case DecimalType:
+		v.decimal, err = strconv.ParseFloat(string(raw), 64)
+	case IntegerType:
+		if base != 10 {
+			raw = raw[2:]
+		}
+
+		v.integer, err = strconv.ParseInt(string(raw), base, 64)
+	case StringType:
+		v.str = string(raw)
+	case QuotedStringType:
+		v.str = string(raw[1 : len(raw)-1])
+	case BoolType:
+		v.boolean = runeCompare(v.raw, runesTrue)
+	}
+
+	// issue 2253
+	//
+	// if the value trying to be parsed is too large, then we will use
+	// the 'StringType' and raw value instead.
+	if nerr, ok := err.(*strconv.NumError); ok && nerr.Err == strconv.ErrRange {
+		v.Type = StringType
+		v.str = string(raw)
+		err = nil
+	}
+
+	return v, err
+}
+
+// Append will append values and change the type to a string
+// type.
+func (v *Value) Append(tok Token) {
+	r := tok.Raw()
+	if v.Type != QuotedStringType {
+		v.Type = StringType
+		r = tok.raw[1 : len(tok.raw)-1]
+	}
+	if tok.Type() != TokenLit {
+		v.raw = append(v.raw, tok.Raw()...)
+	} else {
+		v.raw = append(v.raw, r...)
+	}
+}
+
+func (v Value) String() string {
+	switch v.Type {
+	case DecimalType:
+		return fmt.Sprintf("decimal: %f", v.decimal)
+	case IntegerType:
+		return fmt.Sprintf("integer: %d", v.integer)
+	case StringType:
+		return fmt.Sprintf("string: %s", string(v.raw))
+	case QuotedStringType:
+		return fmt.Sprintf("quoted string: %s", string(v.raw))
+	case BoolType:
+		return fmt.Sprintf("bool: %t", v.boolean)
+	default:
+		return "union not set"
+	}
+}
+
+func newLitToken(b []rune) (Token, int, error) {
+	n := 0
+	var err error
+
+	token := Token{}
+	if b[0] == '"' {
+		n, err = getStringValue(b)
+		if err != nil {
+			return token, n, err
+		}
+
+		token = newToken(TokenLit, b[:n], QuotedStringType)
+	} else if isNumberValue(b) {
+		var base int
+		base, n, err = getNumericalValue(b)
+		if err != nil {
+			return token, 0, err
+		}
+
+		value := b[:n]
+		vType := IntegerType
+		if contains(value, '.') || hasExponent(value) {
+			vType = DecimalType
+		}
+		token = newToken(TokenLit, value, vType)
+		token.base = base
+	} else if isBoolValue(b) {
+		n, err = getBoolValue(b)
+
+		token = newToken(TokenLit, b[:n], BoolType)
+	} else {
+		n, err = getValue(b)
+		token = newToken(TokenLit, b[:n], StringType)
+	}
+
+	return token, n, err
+}
+
+// IntValue returns an integer value
+func (v Value) IntValue() int64 {
+	return v.integer
+}
+
+// FloatValue returns a float value
+func (v Value) FloatValue() float64 {
+	return v.decimal
+}
+
+// BoolValue returns a bool value
+func (v Value) BoolValue() bool {
+	return v.boolean
+}
+
+func isTrimmable(r rune) bool {
+	switch r {
+	case '\n', ' ':
+		return true
+	}
+	return false
+}
+
+// StringValue returns the string value
+func (v Value) StringValue() string {
+	switch v.Type {
+	case StringType:
+		return strings.TrimFunc(string(v.raw), isTrimmable)
+	case QuotedStringType:
+		// preserve all characters in the quotes
+		return string(removeEscapedCharacters(v.raw[1 : len(v.raw)-1]))
+	default:
+		return strings.TrimFunc(string(v.raw), isTrimmable)
+	}
+}
+
+func contains(runes []rune, c rune) bool {
+	for i := 0; i < len(runes); i++ {
+		if runes[i] == c {
+			return true
+		}
+	}
+
+	return false
+}
+
+func runeCompare(v1 []rune, v2 []rune) bool {
+	if len(v1) != len(v2) {
+		return false
+	}
+
+	for i := 0; i < len(v1); i++ {
+		if v1[i] != v2[i] {
+			return false
+		}
+	}
+
+	return true
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/newline_token.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/newline_token.go
new file mode 100644
index 00000000..e52ac399
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/newline_token.go
@@ -0,0 +1,30 @@
+package ini
+
+func isNewline(b []rune) bool {
+	if len(b) == 0 {
+		return false
+	}
+
+	if b[0] == '\n' {
+		return true
+	}
+
+	if len(b) < 2 {
+		return false
+	}
+
+	return b[0] == '\r' && b[1] == '\n'
+}
+
+func newNewlineToken(b []rune) (Token, int, error) {
+	i := 1
+	if b[0] == '\r' && isNewline(b[1:]) {
+		i++
+	}
+
+	if !isNewline([]rune(b[:i])) {
+		return emptyToken, 0, NewParseError("invalid new line token")
+	}
+
+	return newToken(TokenNL, b[:i], NoneType), i, nil
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/number_helper.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/number_helper.go
new file mode 100644
index 00000000..a45c0bc5
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/number_helper.go
@@ -0,0 +1,152 @@
+package ini
+
+import (
+	"bytes"
+	"fmt"
+	"strconv"
+)
+
+const (
+	none = numberFormat(iota)
+	binary
+	octal
+	decimal
+	hex
+	exponent
+)
+
+type numberFormat int
+
+// numberHelper is used to dictate what format a number is in
+// and what to do for negative values. Since -1e-4 is a valid
+// number, we cannot just simply check for duplicate negatives.
+type numberHelper struct {
+	numberFormat numberFormat
+
+	negative         bool
+	negativeExponent bool
+}
+
+func (b numberHelper) Exists() bool {
+	return b.numberFormat != none
+}
+
+func (b numberHelper) IsNegative() bool {
+	return b.negative || b.negativeExponent
+}
+
+func (b *numberHelper) Determine(c rune) error {
+	if b.Exists() {
+		return NewParseError(fmt.Sprintf("multiple number formats: 0%v", string(c)))
+	}
+
+	switch c {
+	case 'b':
+		b.numberFormat = binary
+	case 'o':
+		b.numberFormat = octal
+	case 'x':
+		b.numberFormat = hex
+	case 'e', 'E':
+		b.numberFormat = exponent
+	case '-':
+		if b.numberFormat != exponent {
+			b.negative = true
+		} else {
+			b.negativeExponent = true
+		}
+	case '.':
+		b.numberFormat = decimal
+	default:
+		return NewParseError(fmt.Sprintf("invalid number character: %v", string(c)))
+	}
+
+	return nil
+}
+
+func (b numberHelper) CorrectByte(c rune) bool {
+	switch {
+	case b.numberFormat == binary:
+		if !isBinaryByte(c) {
+			return false
+		}
+	case b.numberFormat == octal:
+		if !isOctalByte(c) {
+			return false
+		}
+	case b.numberFormat == hex:
+		if !isHexByte(c) {
+			return false
+		}
+	case b.numberFormat == decimal:
+		if !isDigit(c) {
+			return false
+		}
+	case b.numberFormat == exponent:
+		if !isDigit(c) {
+			return false
+		}
+	case b.negativeExponent:
+		if !isDigit(c) {
+			return false
+		}
+	case b.negative:
+		if !isDigit(c) {
+			return false
+		}
+	default:
+		if !isDigit(c) {
+			return false
+		}
+	}
+
+	return true
+}
+
+func (b numberHelper) Base() int {
+	switch b.numberFormat {
+	case binary:
+		return 2
+	case octal:
+		return 8
+	case hex:
+		return 16
+	default:
+		return 10
+	}
+}
+
+func (b numberHelper) String() string {
+	buf := bytes.Buffer{}
+	i := 0
+
+	switch b.numberFormat {
+	case binary:
+		i++
+		buf.WriteString(strconv.Itoa(i) + ": binary format\n")
+	case octal:
+		i++
+		buf.WriteString(strconv.Itoa(i) + ": octal format\n")
+	case hex:
+		i++
+		buf.WriteString(strconv.Itoa(i) + ": hex format\n")
+	case exponent:
+		i++
+		buf.WriteString(strconv.Itoa(i) + ": exponent format\n")
+	default:
+		i++
+		buf.WriteString(strconv.Itoa(i) + ": integer format\n")
+	}
+
+	if b.negative {
+		i++
+		buf.WriteString(strconv.Itoa(i) + ": negative format\n")
+	}
+
+	if b.negativeExponent {
+		i++
+		buf.WriteString(strconv.Itoa(i) + ": negative exponent format\n")
+	}
+
+	return buf.String()
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/op_tokens.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/op_tokens.go
new file mode 100644
index 00000000..8a84c7cb
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/op_tokens.go
@@ -0,0 +1,39 @@
+package ini
+
+import (
+	"fmt"
+)
+
+var (
+	equalOp      = []rune("=")
+	equalColonOp = []rune(":")
+)
+
+func isOp(b []rune) bool {
+	if len(b) == 0 {
+		return false
+	}
+
+	switch b[0] {
+	case '=':
+		return true
+	case ':':
+		return true
+	default:
+		return false
+	}
+}
+
+func newOpToken(b []rune) (Token, int, error) {
+	tok := Token{}
+
+	switch b[0] {
+	case '=':
+		tok = newToken(TokenOp, equalOp, NoneType)
+	case ':':
+		tok = newToken(TokenOp, equalColonOp, NoneType)
+	default:
+		return tok, 0, NewParseError(fmt.Sprintf("unexpected op type, %v", b[0]))
+	}
+	return tok, 1, nil
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/parse_error.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/parse_error.go
new file mode 100644
index 00000000..45728701
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/parse_error.go
@@ -0,0 +1,43 @@
+package ini
+
+import "fmt"
+
+const (
+	// ErrCodeParseError is returned when a parsing error
+	// has occurred.
+	ErrCodeParseError = "INIParseError"
+)
+
+// ParseError is an error which is returned during any part of
+// the parsing process.
+type ParseError struct {
+	msg string
+}
+
+// NewParseError will return a new ParseError where message
+// is the description of the error.
+func NewParseError(message string) *ParseError {
+	return &ParseError{
+		msg: message,
+	}
+}
+
+// Code will return the ErrCodeParseError
+func (err *ParseError) Code() string {
+	return ErrCodeParseError
+}
+
+// Message returns the error's message
+func (err *ParseError) Message() string {
+	return err.msg
+}
+
+// OrigError return nothing since there will never be any
+// original error.
+func (err *ParseError) OrigError() error {
+	return nil
+}
+
+func (err *ParseError) Error() string {
+	return fmt.Sprintf("%s: %s", err.Code(), err.Message())
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/parse_stack.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/parse_stack.go
new file mode 100644
index 00000000..7f01cf7c
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/parse_stack.go
@@ -0,0 +1,60 @@
+package ini
+
+import (
+	"bytes"
+	"fmt"
+)
+
+// ParseStack is a stack that contains a container, the stack portion,
+// and the list which is the list of ASTs that have been successfully
+// parsed.
+type ParseStack struct {
+	top       int
+	container []AST
+	list      []AST
+	index     int
+}
+
+func newParseStack(sizeContainer, sizeList int) ParseStack {
+	return ParseStack{
+		container: make([]AST, sizeContainer),
+		list:      make([]AST, sizeList),
+	}
+}
+
+// Pop will return and truncate the last container element.
+func (s *ParseStack) Pop() AST {
+	s.top--
+	return s.container[s.top]
+}
+
+// Push will add the new AST to the container
+func (s *ParseStack) Push(ast AST) {
+	s.container[s.top] = ast
+	s.top++
+}
+
+// MarkComplete will append the AST to the list of completed statements
+func (s *ParseStack) MarkComplete(ast AST) {
+	s.list[s.index] = ast
+	s.index++
+}
+
+// List will return the completed statements
+func (s ParseStack) List() []AST {
+	return s.list[:s.index]
+}
+
+// Len will return the length of the container
+func (s *ParseStack) Len() int {
+	return s.top
+}
+
+func (s ParseStack) String() string {
+	buf := bytes.Buffer{}
+	for i, node := range s.list {
+		buf.WriteString(fmt.Sprintf("%d: %v\n", i+1, node))
+	}
+
+	return buf.String()
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/sep_tokens.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/sep_tokens.go
new file mode 100644
index 00000000..f82095ba
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/sep_tokens.go
@@ -0,0 +1,41 @@
+package ini
+
+import (
+	"fmt"
+)
+
+var (
+	emptyRunes = []rune{}
+)
+
+func isSep(b []rune) bool {
+	if len(b) == 0 {
+		return false
+	}
+
+	switch b[0] {
+	case '[', ']':
+		return true
+	default:
+		return false
+	}
+}
+
+var (
+	openBrace  = []rune("[")
+	closeBrace = []rune("]")
+)
+
+func newSepToken(b []rune) (Token, int, error) {
+	tok := Token{}
+
+	switch b[0] {
+	case '[':
+		tok = newToken(TokenSep, openBrace, NoneType)
+	case ']':
+		tok = newToken(TokenSep, closeBrace, NoneType)
+	default:
+		return tok, 0, NewParseError(fmt.Sprintf("unexpected sep type, %v", b[0]))
+	}
+	return tok, 1, nil
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/skipper.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/skipper.go
new file mode 100644
index 00000000..6bb69644
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/skipper.go
@@ -0,0 +1,45 @@
+package ini
+
+// skipper is used to skip certain blocks of an ini file.
+// Currently skipper is used to skip nested blocks of ini
+// files. See example below
+//
+//	[ foo ]
+//	nested = ; this section will be skipped
+//		a=b
+//		c=d
+//	bar=baz ; this will be included
+type skipper struct {
+	shouldSkip bool
+	TokenSet   bool
+	prevTok    Token
+}
+
+func newSkipper() skipper {
+	return skipper{
+		prevTok: emptyToken,
+	}
+}
+
+func (s *skipper) ShouldSkip(tok Token) bool {
+	if s.shouldSkip &&
+		s.prevTok.Type() == TokenNL &&
+		tok.Type() != TokenWS {
+
+		s.Continue()
+		return false
+	}
+	s.prevTok = tok
+
+	return s.shouldSkip
+}
+
+func (s *skipper) Skip() {
+	s.shouldSkip = true
+	s.prevTok = emptyToken
+}
+
+func (s *skipper) Continue() {
+	s.shouldSkip = false
+	s.prevTok = emptyToken
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/statement.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/statement.go
new file mode 100644
index 00000000..18f3fe89
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/statement.go
@@ -0,0 +1,35 @@
+package ini
+
+// Statement is an empty AST mostly used for transitioning states.
+func newStatement() AST {
+	return newAST(ASTKindStatement, AST{})
+}
+
+// SectionStatement represents a section AST
+func newSectionStatement(tok Token) AST {
+	return newASTWithRootToken(ASTKindSectionStatement, tok)
+}
+
+// ExprStatement represents a completed expression AST
+func newExprStatement(ast AST) AST {
+	return newAST(ASTKindExprStatement, ast)
+}
+
+// CommentStatement represents a comment in the ini definition.
+//
+//	grammar:
+//	comment -> #comment' | ;comment'
+//	comment' -> epsilon | value
+func newCommentStatement(tok Token) AST {
+	return newAST(ASTKindCommentStatement, newExpression(tok))
+}
+
+// CompletedSectionStatement represents a completed section
+func newCompletedSectionStatement(ast AST) AST {
+	return newAST(ASTKindCompletedSectionStatement, ast)
+}
+
+// SkipStatement is used to skip whole statements
+func newSkipStatement(ast AST) AST {
+	return newAST(ASTKindSkipStatement, ast)
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/value_util.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/value_util.go
new file mode 100644
index 00000000..305999d2
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/value_util.go
@@ -0,0 +1,284 @@
+package ini
+
+import (
+	"fmt"
+)
+
+// getStringValue will return a quoted string and the amount
+// of bytes read
+//
+// an error will be returned if the string is not properly formatted
+func getStringValue(b []rune) (int, error) {
+	if b[0] != '"' {
+		return 0, NewParseError("strings must start with '\"'")
+	}
+
+	endQuote := false
+	i := 1
+
+	for ; i < len(b) && !endQuote; i++ {
+		if escaped := isEscaped(b[:i], b[i]); b[i] == '"' && !escaped {
+			endQuote = true
+			break
+		} else if escaped {
+			/*c, err := getEscapedByte(b[i])
+			if err != nil {
+				return 0, err
+			}
+
+			b[i-1] = c
+			b = append(b[:i], b[i+1:]...)
+			i--*/
+
+			continue
+		}
+	}
+
+	if !endQuote {
+		return 0, NewParseError("missing '\"' in string value")
+	}
+
+	return i + 1, nil
+}
+
+// getBoolValue will return a boolean and the amount
+// of bytes read
+//
+// an error will be returned if the boolean is not of a correct
+// value
+func getBoolValue(b []rune) (int, error) {
+	if len(b) < 4 {
+		return 0, NewParseError("invalid boolean value")
+	}
+
+	n := 0
+	for _, lv := range literalValues {
+		if len(lv) > len(b) {
+			continue
+		}
+
+		if isLitValue(lv, b) {
+			n = len(lv)
+		}
+	}
+
+	if n == 0 {
+		return 0, NewParseError("invalid boolean value")
+	}
+
+	return n, nil
+}
+
+// getNumericalValue will return a numerical string, the amount
+// of bytes read, and the base of the number
+//
+// an error will be returned if the number is not of a correct
+// value
+func getNumericalValue(b []rune) (int, int, error) {
+	if !isDigit(b[0]) {
+		return 0, 0, NewParseError("invalid digit value")
+	}
+
+	i := 0
+	helper := numberHelper{}
+
+loop:
+	for negativeIndex := 0; i < len(b); i++ {
+		negativeIndex++
+
+		if !isDigit(b[i]) {
+			switch b[i] {
+			case '-':
+				if helper.IsNegative() || negativeIndex != 1 {
+					return 0, 0, NewParseError("parse error '-'")
+				}
+
+				n := getNegativeNumber(b[i:])
+				i += (n - 1)
+				helper.Determine(b[i])
+				continue
+			case '.':
+				if err := helper.Determine(b[i]); err != nil {
+					return 0, 0, err
+				}
+			case 'e', 'E':
+				if err := helper.Determine(b[i]); err != nil {
+					return 0, 0, err
+				}
+
+				negativeIndex = 0
+			case 'b':
+				if helper.numberFormat == hex {
+					break
+				}
+				fallthrough
+			case 'o', 'x':
+				if i == 0 && b[i] != '0' {
+					return 0, 0, NewParseError("incorrect base format, expected leading '0'")
+				}
+
+				if i != 1 {
+					return 0, 0, NewParseError(fmt.Sprintf("incorrect base format found %s at %d index", string(b[i]), i))
+				}
+
+				if err := helper.Determine(b[i]); err != nil {
+					return 0, 0, err
+				}
+			default:
+				if isWhitespace(b[i]) {
+					break loop
+				}
+
+				if isNewline(b[i:]) {
+					break loop
+				}
+
+				if !(helper.numberFormat == hex && isHexByte(b[i])) {
+					if i+2 < len(b) && !isNewline(b[i:i+2]) {
+						return 0, 0, NewParseError("invalid numerical character")
+					} else if !isNewline([]rune{b[i]}) {
+						return 0, 0, NewParseError("invalid numerical character")
+					}
+
+					break loop
+				}
+			}
+		}
+	}
+
+	return helper.Base(), i, nil
+}
+
+// isDigit will return whether or not something is an integer
+func isDigit(b rune) bool {
+	return b >= '0' && b <= '9'
+}
+
+func hasExponent(v []rune) bool {
+	return contains(v, 'e') || contains(v, 'E')
+}
+
+func isBinaryByte(b rune) bool {
+	switch b {
+	case '0', '1':
+		return true
+	default:
+		return false
+	}
+}
+
+func isOctalByte(b rune) bool {
+	switch b {
+	case '0', '1', '2', '3', '4', '5', '6', '7':
+		return true
+	default:
+		return false
+	}
+}
+
+func isHexByte(b rune) bool {
+	if isDigit(b) {
+		return true
+	}
+	return (b >= 'A' && b <= 'F') ||
+		(b >= 'a' && b <= 'f')
+}
+
+func getValue(b []rune) (int, error) {
+	i := 0
+
+	for i < len(b) {
+		if isNewline(b[i:]) {
+			break
+		}
+
+		if isOp(b[i:]) {
+			break
+		}
+
+		valid, n, err := isValid(b[i:])
+		if err != nil {
+			return 0, err
+		}
+
+		if !valid {
+			break
+		}
+
+		i += n
+	}
+
+	return i, nil
+}
+
+// getNegativeNumber will return a negative number from a
+// byte slice. This will iterate through all characters until
+// a non-digit has been found.
+func getNegativeNumber(b []rune) int {
+	if b[0] != '-' {
+		return 0
+	}
+
+	i := 1
+	for ; i < len(b); i++ {
+		if !isDigit(b[i]) {
+			return i
+		}
+	}
+
+	return i
+}
+
+// isEscaped will return whether or not the character is an escaped
+// character.
+func isEscaped(value []rune, b rune) bool {
+	if len(value) == 0 {
+		return false
+	}
+
+	switch b {
+	case '\'': // single quote
+	case '"': // quote
+	case 'n': // newline
+	case 't': // tab
+	case '\\': // backslash
+	default:
+		return false
+	}
+
+	return value[len(value)-1] == '\\'
+}
+
+func getEscapedByte(b rune) (rune, error) {
+	switch b {
+	case '\'': // single quote
+		return '\'', nil
+	case '"': // quote
+		return '"', nil
+	case 'n': // newline
+		return '\n', nil
+	case 't': // table
+		return '\t', nil
+	case '\\': // backslash
+		return '\\', nil
+	default:
+		return b, NewParseError(fmt.Sprintf("invalid escaped character %c", b))
+	}
+}
+
+func removeEscapedCharacters(b []rune) []rune {
+	for i := 0; i < len(b); i++ {
+		if isEscaped(b[:i], b[i]) {
+			c, err := getEscapedByte(b[i])
+			if err != nil {
+				return b
+			}
+
+			b[i-1] = c
+			b = append(b[:i], b[i+1:]...)
+			i--
+		}
+	}
+
+	return b
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/visitor.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/visitor.go
new file mode 100644
index 00000000..94841c32
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/visitor.go
@@ -0,0 +1,166 @@
+package ini
+
+import (
+	"fmt"
+	"sort"
+)
+
+// Visitor is an interface used by walkers that will
+// traverse an array of ASTs.
+type Visitor interface {
+	VisitExpr(AST) error
+	VisitStatement(AST) error
+}
+
+// DefaultVisitor is used to visit statements and expressions
+// and ensure that they are both of the correct format.
+// In addition, upon visiting this will build sections and populate
+// the Sections field which can be used to retrieve profile
+// configuration.
+type DefaultVisitor struct {
+	scope    string
+	Sections Sections
+}
+
+// NewDefaultVisitor return a DefaultVisitor
+func NewDefaultVisitor() *DefaultVisitor {
+	return &DefaultVisitor{
+		Sections: Sections{
+			container: map[string]Section{},
+		},
+	}
+}
+
+// VisitExpr visits expressions...
+func (v *DefaultVisitor) VisitExpr(expr AST) error {
+	t := v.Sections.container[v.scope]
+	if t.values == nil {
+		t.values = values{}
+	}
+
+	switch expr.Kind {
+	case ASTKindExprStatement:
+		opExpr := expr.GetRoot()
+		switch opExpr.Kind {
+		case ASTKindEqualExpr:
+			children := opExpr.GetChildren()
+			if len(children) <= 1 {
+				return NewParseError("unexpected token type")
+			}
+
+			rhs := children[1]
+
+			if rhs.Root.Type() != TokenLit {
+				return NewParseError("unexpected token type")
+			}
+
+			key := EqualExprKey(opExpr)
+			v, err := newValue(rhs.Root.ValueType, rhs.Root.base, rhs.Root.Raw())
+			if err != nil {
+				return err
+			}
+
+			t.values[key] = v
+		default:
+			return NewParseError(fmt.Sprintf("unsupported expression %v", expr))
+		}
+	default:
+		return NewParseError(fmt.Sprintf("unsupported expression %v", expr))
+	}
+
+	v.Sections.container[v.scope] = t
+	return nil
+}
+
+// VisitStatement visits statements...
+func (v *DefaultVisitor) VisitStatement(stmt AST) error {
+	switch stmt.Kind {
+	case ASTKindCompletedSectionStatement:
+		child := stmt.GetRoot()
+		if child.Kind != ASTKindSectionStatement {
+			return NewParseError(fmt.Sprintf("unsupported child statement: %T", child))
+		}
+
+		name := string(child.Root.Raw())
+		v.Sections.container[name] = Section{}
+		v.scope = name
+	default:
+		return NewParseError(fmt.Sprintf("unsupported statement: %s", stmt.Kind))
+	}
+
+	return nil
+}
+
+// Sections is a map of Section structures that represent
+// a configuration.
+type Sections struct {
+	container map[string]Section
+}
+
+// GetSection will return section p. If section p does not exist,
+// false will be returned in the second parameter.
+func (t Sections) GetSection(p string) (Section, bool) {
+	v, ok := t.container[p]
+	return v, ok
+}
+
+// values represents a map of union values.
+type values map[string]Value
+
+// List will return a list of all sections that were successfully
+// parsed.
+func (t Sections) List() []string {
+	keys := make([]string, len(t.container))
+	i := 0
+	for k := range t.container {
+		keys[i] = k
+		i++
+	}
+
+	sort.Strings(keys)
+	return keys
+}
+
+// Section contains a name and values. This represent
+// a sectioned entry in a configuration file.
+type Section struct {
+	Name   string
+	values values
+}
+
+// Has will return whether or not an entry exists in a given section
+func (t Section) Has(k string) bool {
+	_, ok := t.values[k]
+	return ok
+}
+
+// ValueType will returned what type the union is set to. If
+// k was not found, the NoneType will be returned.
+func (t Section) ValueType(k string) (ValueType, bool) {
+	v, ok := t.values[k]
+	return v.Type, ok
+}
+
+// Bool returns a bool value at k
+func (t Section) Bool(k string) bool {
+	return t.values[k].BoolValue()
+}
+
+// Int returns an integer value at k
+func (t Section) Int(k string) int64 {
+	return t.values[k].IntValue()
+}
+
+// Float64 returns a float value at k
+func (t Section) Float64(k string) float64 {
+	return t.values[k].FloatValue()
+}
+
+// String returns the string value at k
+func (t Section) String(k string) string {
+	_, ok := t.values[k]
+	if !ok {
+		return ""
+	}
+	return t.values[k].StringValue()
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/walker.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/walker.go
new file mode 100644
index 00000000..99915f7f
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/walker.go
@@ -0,0 +1,25 @@
+package ini
+
+// Walk will traverse the AST using the v, the Visitor.
+func Walk(tree []AST, v Visitor) error {
+	for _, node := range tree {
+		switch node.Kind {
+		case ASTKindExpr,
+			ASTKindExprStatement:
+
+			if err := v.VisitExpr(node); err != nil {
+				return err
+			}
+		case ASTKindStatement,
+			ASTKindCompletedSectionStatement,
+			ASTKindNestedSectionStatement,
+			ASTKindCompletedNestedSectionStatement:
+
+			if err := v.VisitStatement(node); err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/ws_token.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/ws_token.go
new file mode 100644
index 00000000..7ffb4ae0
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/ini/ws_token.go
@@ -0,0 +1,24 @@
+package ini
+
+import (
+	"unicode"
+)
+
+// isWhitespace will return whether or not the character is
+// a whitespace character.
+//
+// Whitespace is defined as a space or tab.
+func isWhitespace(c rune) bool {
+	return unicode.IsSpace(c) && c != '\n' && c != '\r'
+}
+
+func newWSToken(b []rune) (Token, int, error) {
+	i := 0
+	for ; i < len(b); i++ {
+		if !isWhitespace(b[i]) {
+			break
+		}
+	}
+
+	return newToken(TokenWS, b[:i], NoneType), i, nil
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/sdkio/io_go1.6.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/sdkio/io_go1.6.go
new file mode 100644
index 00000000..5aa9137e
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/sdkio/io_go1.6.go
@@ -0,0 +1,10 @@
+// +build !go1.7
+
+package sdkio
+
+// Copy of Go 1.7 io package's Seeker constants.
+const (
+	SeekStart   = 0 // seek relative to the origin of the file
+	SeekCurrent = 1 // seek relative to the current offset
+	SeekEnd     = 2 // seek relative to the end
+)
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/sdkio/io_go1.7.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/sdkio/io_go1.7.go
new file mode 100644
index 00000000..e5f00561
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/sdkio/io_go1.7.go
@@ -0,0 +1,12 @@
+// +build go1.7
+
+package sdkio
+
+import "io"
+
+// Alias for Go 1.7 io package Seeker constants
+const (
+	SeekStart   = io.SeekStart   // seek relative to the origin of the file
+	SeekCurrent = io.SeekCurrent // seek relative to the current offset
+	SeekEnd     = io.SeekEnd     // seek relative to the end
+)
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/sdkrand/locked_source.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/sdkrand/locked_source.go
new file mode 100644
index 00000000..0c9802d8
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/sdkrand/locked_source.go
@@ -0,0 +1,29 @@
+package sdkrand
+
+import (
+	"math/rand"
+	"sync"
+	"time"
+)
+
+// lockedSource is a thread-safe implementation of rand.Source
+type lockedSource struct {
+	lk  sync.Mutex
+	src rand.Source
+}
+
+func (r *lockedSource) Int63() (n int64) {
+	r.lk.Lock()
+	n = r.src.Int63()
+	r.lk.Unlock()
+	return
+}
+
+func (r *lockedSource) Seed(seed int64) {
+	r.lk.Lock()
+	r.src.Seed(seed)
+	r.lk.Unlock()
+}
+
+// SeededRand is a new RNG using a thread safe implementation of rand.Source
+var SeededRand = rand.New(&lockedSource{src: rand.NewSource(time.Now().UnixNano())})
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/sdkuri/path.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/sdkuri/path.go
new file mode 100644
index 00000000..38ea61af
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/sdkuri/path.go
@@ -0,0 +1,23 @@
+package sdkuri
+
+import (
+	"path"
+	"strings"
+)
+
+// PathJoin will join the elements of the path delimited by the "/"
+// character. Similar to path.Join with the exception the trailing "/"
+// character is preserved if present.
+func PathJoin(elems ...string) string {
+	if len(elems) == 0 {
+		return ""
+	}
+
+	hasTrailing := strings.HasSuffix(elems[len(elems)-1], "/")
+	str := path.Join(elems...)
+	if hasTrailing && str != "/" {
+		str += "/"
+	}
+
+	return str
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/shareddefaults/ecs_container.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/shareddefaults/ecs_container.go
new file mode 100644
index 00000000..7da8a49c
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/shareddefaults/ecs_container.go
@@ -0,0 +1,12 @@
+package shareddefaults
+
+const (
+	// ECSCredsProviderEnvVar is an environmental variable key used to
+	// determine which path needs to be hit.
+	ECSCredsProviderEnvVar = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"
+)
+
+// ECSContainerCredentialsURI is the endpoint to retrieve container
+// credentials. This can be overridden to test to ensure the credential process
+// is behaving correctly.
+var ECSContainerCredentialsURI = "http://169.254.170.2"
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/shareddefaults/shared_config.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/shareddefaults/shared_config.go
new file mode 100644
index 00000000..ebcbc2b4
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-sdk-go/internal/shareddefaults/shared_config.go
@@ -0,0 +1,40 @@
+package shareddefaults
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+)
+
+// SharedCredentialsFilename returns the SDK's default file path
+// for the shared credentials file.
+//
+// Builds the shared config file path based on the OS's platform.
+//
+//   - Linux/Unix: $HOME/.aws/credentials
+//   - Windows: %USERPROFILE%\.aws\credentials
+func SharedCredentialsFilename() string {
+	return filepath.Join(UserHomeDir(), ".aws", "credentials")
+}
+
+// SharedConfigFilename returns the SDK's default file path for
+// the shared config file.
+//
+// Builds the shared config file path based on the OS's platform.
+//
+//   - Linux/Unix: $HOME/.aws/config
+//   - Windows: %USERPROFILE%\.aws\config
+func SharedConfigFilename() string {
+	return filepath.Join(UserHomeDir(), ".aws", "config")
+}
+
+// UserHomeDir returns the home directory for the user the process is
+// running under.
+func UserHomeDir() string {
+	if runtime.GOOS == "windows" { // Windows
+		return os.Getenv("USERPROFILE")
+	}
+
+	// *nix
+	return os.Getenv("HOME")
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/CONTRIBUTORS.md b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/CONTRIBUTORS.md
new file mode 100644
index 00000000..39f91bf0
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/CONTRIBUTORS.md
@@ -0,0 +1,8 @@
+# Contributors
+The following people have contributed to the AWS X-Ray SDK for Go's design and/or implementation (alphabetical):
+* Anssi Alaranta
+* Bilal Khan
+* James Bowman
+* Lulu Zhao
+* Raymond Lin
+* Rohit Banga
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/LICENSE b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/LICENSE
new file mode 100644
index 00000000..8dada3ed
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/NOTICE.txt b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/NOTICE.txt
new file mode 100644
index 00000000..3e0ee43d
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/NOTICE.txt
@@ -0,0 +1,2 @@
+AWS X-Ray SDK for Go
+Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/header/header.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/header/header.go
new file mode 100644
index 00000000..7d5f12b5
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/header/header.go
@@ -0,0 +1,134 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package header
+
+import (
+	"bytes"
+	"strings"
+)
+
+const (
+	// RootPrefix is the prefix for
+	// Root attribute in X-Amzn-Trace-Id.
+	RootPrefix = "Root="
+
+	// ParentPrefix is the prefix for
+	// Parent attribute in X-Amzn-Trace-Id.
+	ParentPrefix = "Parent="
+
+	// SampledPrefix is the prefix for
+	// Sampled attribute in X-Amzn-Trace-Id.
+	SampledPrefix = "Sampled="
+
+	// SelfPrefix is the prefix for
+	// Self attribute in X-Amzn-Trace-Id.
+	SelfPrefix = "Self="
+)
+
+// SamplingDecision is a string representation of
+// whether or not the current segment has been sampled.
+type SamplingDecision string
+
+const (
+	// Sampled indicates the current segment has been
+	// sampled and will be sent to the X-Ray daemon.
+	Sampled SamplingDecision = "Sampled=1"
+
+	// NotSampled indicates the current segment has
+	// not been sampled.
+	NotSampled SamplingDecision = "Sampled=0"
+
+	// Requested indicates sampling decision will be
+	// made by the downstream service and propagated
+	// back upstream in the response.
+	Requested SamplingDecision = "Sampled=?"
+
+	// Unknown indicates no sampling decision will be made.
+	Unknown SamplingDecision = ""
+)
+
+func samplingDecision(s string) SamplingDecision {
+	if s == string(Sampled) {
+		return Sampled
+	} else if s == string(NotSampled) {
+		return NotSampled
+	} else if s == string(Requested) {
+		return Requested
+	}
+	return Unknown
+}
+
+// Header is the value of X-Amzn-Trace-Id.
+type Header struct {
+	TraceID          string
+	ParentID         string
+	SamplingDecision SamplingDecision
+
+	AdditionalData map[string]string
+}
+
+// FromString gets individual value for each item in Header struct.
+func FromString(s string) *Header {
+	ret := &Header{
+		SamplingDecision: Unknown,
+		AdditionalData:   make(map[string]string),
+	}
+	parts := strings.Split(s, ";")
+	for i := range parts {
+		p := strings.TrimSpace(parts[i])
+		value, valid := valueFromKeyValuePair(p)
+		if valid {
+			if strings.HasPrefix(p, RootPrefix) {
+				ret.TraceID = value
+			} else if strings.HasPrefix(p, ParentPrefix) {
+				ret.ParentID = value
+			} else if strings.HasPrefix(p, SampledPrefix) {
+				ret.SamplingDecision = samplingDecision(p)
+			} else if !strings.HasPrefix(p, SelfPrefix) {
+				key, valid := keyFromKeyValuePair(p)
+				if valid {
+					ret.AdditionalData[key] = value
+				}
+			}
+		}
+	}
+	return ret
+}
+
+// String returns a string representation for header.
+func (h Header) String() string {
+	var p [][]byte
+	if h.TraceID != "" {
+		p = append(p, []byte(RootPrefix+h.TraceID))
+	}
+	if h.ParentID != "" {
+		p = append(p, []byte(ParentPrefix+h.ParentID))
+	}
+	p = append(p, []byte(h.SamplingDecision))
+	for key := range h.AdditionalData {
+		p = append(p, []byte(key+"="+h.AdditionalData[key]))
+	}
+	return string(bytes.Join(p, []byte(";")))
+}
+
+func keyFromKeyValuePair(s string) (string, bool) {
+	e := strings.Index(s, "=")
+	if -1 != e {
+		return s[:e], true
+	}
+	return "", false
+}
+
+func valueFromKeyValuePair(s string) (string, bool) {
+	e := strings.Index(s, "=")
+	if -1 != e {
+		return s[e+1:], true
+	}
+	return "", false
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/internal/plugins/plugin.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/internal/plugins/plugin.go
new file mode 100644
index 00000000..f19983db
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/internal/plugins/plugin.go
@@ -0,0 +1,40 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package plugins
+
+import (
+	"github.com/aws/aws-sdk-go/aws/ec2metadata"
+)
+
+// InstancePluginMetadata points to the PluginMetadata struct.
+var InstancePluginMetadata = &PluginMetadata{}
+
+// PluginMetadata struct contains items to record information
+// about the AWS infrastructure hosting the traced application.
+type PluginMetadata struct {
+
+	// IdentityDocument records the shape for unmarshaling an
+	// EC2 instance identity document.
+	IdentityDocument *ec2metadata.EC2InstanceIdentityDocument
+
+	// BeanstalkMetadata records the Elastic Beanstalk
+	// environment name, version label, and deployment ID.
+	BeanstalkMetadata *BeanstalkMetadata
+
+	// ECSContainerName records the ECS container ID.
+	ECSContainerName string
+}
+
+// BeanstalkMetadata provides the shape for unmarshaling
+// Elastic Beanstalk environment metadata.
+type BeanstalkMetadata struct {
+	Environment  string `json:"environment_name"`
+	VersionLabel string `json:"version_label"`
+	DeploymentID int    `json:"deployment_id"`
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/pattern/search_pattern.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/pattern/search_pattern.go
new file mode 100644
index 00000000..aab1aa9d
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/pattern/search_pattern.go
@@ -0,0 +1,97 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+// Package pattern provides a basic pattern matching utility.
+// Patterns may contain fixed text, and/or special characters (`*`, `?`).
+// `*` represents 0 or more wildcard characters. `?` represents a single wildcard character.
+package pattern
+
+import "strings"
+
+// WildcardMatchCaseInsensitive returns true if text matches pattern (case-insensitive); returns false otherwise.
+func WildcardMatchCaseInsensitive(pattern string, text string) bool {
+	return WildcardMatch(pattern, text, true)
+}
+
+// WildcardMatch returns true if text matches pattern at the given case-sensitivity; returns false otherwise.
+func WildcardMatch(pattern string, text string, caseInsensitive bool) bool {
+	patternLen := len(pattern)
+	textLen := len(text)
+	if 0 == patternLen {
+		return 0 == textLen
+	}
+
+	if isWildcardGlob(pattern) {
+		return true
+	}
+
+	if caseInsensitive {
+		pattern = strings.ToLower(pattern)
+		text = strings.ToLower(text)
+	}
+
+	indexOfGlob := strings.Index(pattern, "*")
+	if -1 == indexOfGlob || patternLen-1 == indexOfGlob {
+		return simpleWildcardMatch(pattern, text)
+	}
+
+	res := make([]bool, textLen+1)
+	res[0] = true
+	for j := 0; j < patternLen; j++ {
+		p := pattern[j]
+		if '*' != p {
+			for i := textLen - 1; i >= 0; i-- {
+				t := text[i]
+				res[i+1] = res[i] && ('?' == p || t == p)
+			}
+		} else {
+			i := 0
+			for i <= textLen && !res[i] {
+				i++
+			}
+			for i <= textLen {
+				res[i] = true
+				i++
+			}
+		}
+		res[0] = res[0] && '*' == p
+	}
+	return res[textLen]
+
+}
+
+func simpleWildcardMatch(pattern string, text string) bool {
+	j := 0
+	patternLen := len(pattern)
+	textLen := len(text)
+	for i := 0; i < patternLen; i++ {
+		p := pattern[i]
+		if '*' == p {
+			return true
+		} else if '?' == p {
+			if textLen == j {
+				return false
+			}
+			j++
+		} else {
+			if j >= textLen {
+				return false
+			}
+			t := text[j]
+			if p != t {
+				return false
+			}
+			j++
+		}
+	}
+	return j == textLen
+}
+
+func isWildcardGlob(pattern string) bool {
+	return pattern == "*"
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/resources/AWSWhitelist.json b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/resources/AWSWhitelist.json
new file mode 100644
index 00000000..904510d6
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/resources/AWSWhitelist.json
@@ -0,0 +1,452 @@
+{
+  "services": {
+    "dynamodb": {
+      "operations": {
+        "BatchGetItem": {
+          "request_descriptors": {
+            "RequestItems": {
+              "map": true,
+              "get_keys": true,
+              "rename_to": "table_names"
+            }
+          },
+          "response_parameters": [
+            "ConsumedCapacity"
+          ]
+        },
+        "BatchWriteItem": {
+          "request_descriptors": {
+            "RequestItems": {
+              "map": true,
+              "get_keys": true,
+              "rename_to": "table_names"
+            }
+          },
+          "response_parameters": [
+            "ConsumedCapacity",
+            "ItemCollectionMetrics"
+          ]
+        },
+        "CreateTable": {
+          "request_parameters": [
+            "GlobalSecondaryIndexes",
+            "LocalSecondaryIndexes",
+            "ProvisionedThroughput",
+            "TableName"
+          ]
+        },
+        "DeleteItem": {
+          "request_parameters": [
+            "TableName"
+          ],
+          "response_parameters": [
+            "ConsumedCapacity",
+            "ItemCollectionMetrics"
+          ]
+        },
+        "DeleteTable": {
+          "request_parameters": [
+            "TableName"
+          ]
+        },
+        "DescribeTable": {
+          "request_parameters": [
+            "TableName"
+          ]
+        },
+        "GetItem": {
+          "request_parameters": [
+            "ConsistentRead",
+            "ProjectionExpression",
+            "TableName"
+          ],
+          "response_parameters": [
+            "ConsumedCapacity"
+          ]
+        },
+        "ListTables": {
+          "request_parameters": [
+            "ExclusiveStartTableName",
+            "Limit"
+          ],
+          "response_descriptors": {
+            "TableNames": {
+              "list": true,
+              "get_count": true,
+              "rename_to": "table_count"
+            }
+          }
+        },
+        "PutItem": {
+          "request_parameters": [
+            "TableName"
+          ],
+          "response_parameters": [
+            "ConsumedCapacity",
+            "ItemCollectionMetrics"
+          ]
+        },
+        "Query": {
+          "request_parameters": [
+            "AttributesToGet",
+            "ConsistentRead",
+            "IndexName",
+            "Limit",
+            "ProjectionExpression",
+            "ScanIndexForward",
+            "Select",
+            "TableName"
+          ],
+          "response_parameters": [
+            "ConsumedCapacity"
+          ]
+        },
+        "Scan": {
+          "request_parameters": [
+            "AttributesToGet",
+            "ConsistentRead",
+            "IndexName",
+            "Limit",
+            "ProjectionExpression",
+            "Segment",
+            "Select",
+            "TableName",
+            "TotalSegments"
+          ],
+          "response_parameters": [
+            "ConsumedCapacity",
+            "Count",
+            "ScannedCount"
+          ]
+        },
+        "UpdateItem": {
+          "request_parameters": [
+            "TableName"
+          ],
+          "response_parameters": [
+            "ConsumedCapacity",
+            "ItemCollectionMetrics"
+          ]
+        },
+        "UpdateTable": {
+          "request_parameters": [
+            "AttributeDefinitions",
+            "GlobalSecondaryIndexUpdates",
+            "ProvisionedThroughput",
+            "TableName"
+          ]
+        }
+      }
+    },
+    "sqs": {
+      "operations": {
+        "AddPermission": {
+          "request_parameters": [
+            "Label",
+            "QueueUrl"
+          ]
+        },
+        "ChangeMessageVisibility": {
+          "request_parameters": [
+            "QueueUrl",
+            "VisibilityTimeout"
+          ]
+        },
+        "ChangeMessageVisibilityBatch": {
+          "request_parameters": [
+            "QueueUrl"
+          ],
+          "response_parameters": [
+            "Failed"
+          ]
+        },
+        "CreateQueue": {
+          "request_parameters": [
+            "Attributes",
+            "QueueName"
+          ]
+        },
+        "DeleteMessage": {
+          "request_parameters": [
+            "QueueUrl"
+          ]
+        },
+        "DeleteMessageBatch": {
+          "request_parameters": [
+            "QueueUrl"
+          ],
+          "response_parameters": [
+            "Failed"
+          ]
+        },
+        "DeleteQueue": {
+          "request_parameters": [
+            "QueueUrl"
+          ]
+        },
+        "GetQueueAttributes": {
+          "request_parameters": [
+            "QueueUrl"
+          ],
+          "response_parameters": [
+            "Attributes"
+          ]
+        },
+        "GetQueueUrl": {
+          "request_parameters": [
+            "QueueName",
+            "QueueOwnerAWSAccountId"
+          ],
+          "response_parameters": [
+            "QueueUrl"
+          ]
+        },
+        "ListDeadLetterSourceQueues": {
+          "request_parameters": [
+            "QueueUrl"
+          ],
+          "response_parameters": [
+            "QueueUrls"
+          ]
+        },
+        "ListQueues": {
+          "request_parameters": [
+            "QueueNamePrefix"
+          ],
+          "response_descriptors": {
+            "QueueUrls": {
+              "list": true,
+              "get_count": true,
+              "rename_to": "queue_count"
+            }
+          }
+        },
+        "PurgeQueue": {
+          "request_parameters": [
+            "QueueUrl"
+          ]
+        },
+        "ReceiveMessage": {
+          "request_parameters": [
+            "AttributeNames",
+            "MaxNumberOfMessages",
+            "MessageAttributeNames",
+            "QueueUrl",
+            "VisibilityTimeout",
+            "WaitTimeSeconds"
+          ],
+          "response_descriptors": {
+            "Messages": {
+              "list": true,
+              "get_count": true,
+              "rename_to": "message_count"
+            }
+          }
+        },
+        "RemovePermission": {
+          "request_parameters": [
+            "QueueUrl"
+          ]
+        },
+        "SendMessage": {
+          "request_parameters": [
+            "DelaySeconds",
+            "QueueUrl"
+          ],
+          "request_descriptors": {
+            "MessageAttributes": {
+              "map": true,
+              "get_keys": true,
+              "rename_to": "message_attribute_names"
+            }
+          },
+          "response_parameters": [
+            "MessageId"
+          ]
+        },
+        "SendMessageBatch": {
+          "request_parameters": [
+            "QueueUrl"
+          ],
+          "request_descriptors": {
+            "Entries": {
+              "list": true,
+              "get_count": true,
+              "rename_to": "message_count"
+            }
+          },
+          "response_descriptors": {
+            "Failed": {
+              "list": true,
+              "get_count": true,
+              "rename_to": "failed_count"
+            },
+            "Successful": {
+              "list": true,
+              "get_count": true,
+              "rename_to": "successful_count"
+            }
+          }
+        },
+        "SetQueueAttributes": {
+          "request_parameters": [
+            "QueueUrl"
+          ],
+          "request_descriptors": {
+            "Attributes": {
+              "map": true,
+              "get_keys": true,
+              "rename_to": "attribute_names"
+            }
+          }
+        }
+      }
+    },
+    "lambda": {
+      "operations": {
+        "Invoke": {
+          "request_parameters": [
+            "FunctionName",
+            "InvocationType",
+            "LogType",
+            "Qualifier"
+          ],
+          "response_parameters": [
+            "FunctionError",
+            "StatusCode"
+          ]
+        },
+        "InvokeAsync": {
+          "request_parameters": [
+            "FunctionName"
+          ],
+          "response_parameters": [
+            "Status"
+          ]
+        }
+      }
+    },
+    "s3": {
+      "operations": {
+        "CreateBucket": {
+          "request_descriptors": {
+            "Bucket": {
+              "value": true,
+              "rename_to": "bucket_name"
+            }
+          }
+        },
+        "DeleteBucket": {
+          "request_descriptors": {
+            "Bucket": {
+              "value": true,
+              "rename_to": "bucket_name"
+            }
+          }
+        },
+        "GetObject": {
+          "request_parameters": [
+            "Key"
+          ],
+          "request_descriptors": {
+            "Bucket": {
+              "value": true,
+              "rename_to": "bucket_name"
+            }
+          }
+        },
+        "DeleteObject": {
+          "request_parameters": [
+            "Key"
+          ],
+          "request_descriptors": {
+            "Bucket": {
+              "value": true,
+              "rename_to": "bucket_name"
+            }
+          },
+          "response_parameters": [
+            "DeleteMarker"
+          ]
+        },
+        "DeleteObjects": {
+          "request_descriptors": {
+            "Bucket": {
+              "value": true,
+              "rename_to": "bucket_name"
+            }
+          },
+          "response_descriptors": {
+            "Deleted": {
+              "list": true,
+              "get_count": true,
+              "rename_to": "deleted_object_count"
+            }
+          }
+        },
+        "ListBuckets": {
+          "response_descriptors": {
+            "Buckets": {
+              "list": true,
+              "get_count": true,
+              "rename_to": "bucket_count"
+            }
+          }
+        },
+        "ListObjects": {
+          "request_descriptors": {
+            "Bucket": {
+              "value": true,
+              "rename_to": "bucket_name"
+            }
+          },
+          "response_descriptors": {
+            "Contents": {
+              "list": true,
+              "get_count": true,
+              "rename_to": "object_count"
+            }
+          }
+        },
+        "PutObject": {
+          "request_parameters": [
+            "Key"
+          ],
+          "request_descriptors": {
+            "Bucket": {
+              "value": true,
+              "rename_to": "bucket_name"
+            }
+          }
+        },
+        "PutBucketLogging": {
+          "request_descriptors": {
+            "Bucket": {
+              "value": true,
+              "rename_to": "bucket_name"
+            }
+          }
+        },
+        "PutBucketPolicy": {
+          "request_parameters": [
+            "Policy"
+          ],
+          "request_descriptors": {
+            "Bucket": {
+              "value": true,
+              "rename_to": "bucket_name"
+            }
+          }
+        },
+        "PutBucketTagging": {
+          "request_descriptors": {
+            "Bucket": {
+              "value": true,
+              "rename_to": "bucket_name"
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/resources/DefaultSamplingRules.json b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/resources/DefaultSamplingRules.json
new file mode 100644
index 00000000..4855f43f
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/resources/DefaultSamplingRules.json
@@ -0,0 +1,9 @@
+{
+  "version": 1,
+  "default": {
+    "fixed_target": 1,
+    "rate": 0.05
+  },
+  "rules": [
+  ]
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/resources/ExampleSamplingRules.json b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/resources/ExampleSamplingRules.json
new file mode 100644
index 00000000..18ec2de4
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/resources/ExampleSamplingRules.json
@@ -0,0 +1,19 @@
+{
+  "version": 1,
+  "default": {
+    "description": "A default rule, as included below, is required in any sampling rules file. (service_name, http_method, and url_path are fixed to '*' for this rule.)",
+    "fixed_target": 1,
+    "rate": 0.05
+  },
+  "rules": [
+    {
+      "description": "Example path-based rule below. Rules are evaluated in id-order, the default rule will be used if none match the incoming request. This is a rule for the checkout page.",
+      "id": "1",
+      "service_name": "*",
+      "http_method": "*",
+      "url_path": "/checkout",
+      "fixed_target": 10,
+      "rate": 0.05
+    }
+  ]
+}
\ No newline at end of file
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/resources/bindata.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/resources/bindata.go
new file mode 100644
index 00000000..22d05656
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/resources/bindata.go
@@ -0,0 +1,283 @@
+// Code generated by go-bindata.
+// sources:
+// resources/AWSWhitelist.json
+// resources/DefaultSamplingRules.json
+// resources/ExampleSamplingRules.json
+// DO NOT EDIT!
+
+package resources
+
+import (
+	"bytes"
+	"compress/gzip"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+func bindataRead(data []byte, name string) ([]byte, error) {
+	gz, err := gzip.NewReader(bytes.NewBuffer(data))
+	if err != nil {
+		return nil, fmt.Errorf("Read %q: %v", name, err)
+	}
+
+	var buf bytes.Buffer
+	_, err = io.Copy(&buf, gz)
+	clErr := gz.Close()
+
+	if err != nil {
+		return nil, fmt.Errorf("Read %q: %v", name, err)
+	}
+	if clErr != nil {
+		return nil, err
+	}
+
+	return buf.Bytes(), nil
+}
+
+type asset struct {
+	bytes []byte
+	info  os.FileInfo
+}
+
+type bindataFileInfo struct {
+	name    string
+	size    int64
+	mode    os.FileMode
+	modTime time.Time
+}
+
+func (fi bindataFileInfo) Name() string {
+	return fi.name
+}
+func (fi bindataFileInfo) Size() int64 {
+	return fi.size
+}
+func (fi bindataFileInfo) Mode() os.FileMode {
+	return fi.mode
+}
+func (fi bindataFileInfo) ModTime() time.Time {
+	return fi.modTime
+}
+func (fi bindataFileInfo) IsDir() bool {
+	return false
+}
+func (fi bindataFileInfo) Sys() interface{} {
+	return nil
+}
+
+var _resourcesAwswhitelistJson = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xec\x59\xcd\x72\xe2\x38\x10\xbe\xf3\x14\x2e\x9f\x73\xdb\x5b\x6e\x0c\x49\x28\x6a\xc9\x84\x04\x66\x73\xd8\xda\xa2\x64\xa9\x71\x34\xb1\x25\x47\x3f\x0c\xd4\x56\xde\x7d\x4b\x92\x21\x60\x8c\x2d\xec\xc0\x90\x64\x0f\x53\x13\xac\xb6\xfa\xeb\xaf\x7f\xd4\x2d\xff\xdb\x09\x82\x50\x82\x98\x53\x0c\x32\xbc\x0c\xcc\xef\x20\x08\xc9\x92\xa1\x94\x93\x68\xfd\x24\x08\x42\x9e\x81\x40\x8a\x72\x26\x37\x9e\x06\x41\xf8\x0d\x29\xfc\xd4\x07\x35\x50\x90\x6e\xad\x04\x41\x28\xe0\x45\x83\x54\x53\x02\x12\x0b\x9a\x29\x2e\x64\x41\x24\x08\xc2\x07\x27\x64\xde\xdf\x5d\x0d\x82\x30\x45\x59\x78\x19\x28\xa1\xe1\xa2\xb8\x14\x83\x9a\x3e\xc3\x52\xee\x5b\x17\xc0\x50\x0a\x53\xc5\xc3\xcb\x20\x54\x28\x4a\x60\x6a\x1e\xc8\x70\x4b\xf0\x75\xe3\xd7\xeb\xc5\x36\x7e\x99\x71\x26\x61\x9a\x21\x81\x52\x50\x60\xf1\xff\xbd\x8d\xbf\xc7\x99\xd4\x29\x90\x1e\xca\x10\xa6\x6a\xb9\xb9\xf9\x3f\x9d\x92\x8d\x1d\x65\x8f\x82\x2a\xf8\x9f\xb4\x15\x69\xdb\x30\x42\x63\x58\x8f\x27\x09\x60\x13\x72\xb7\xa0\x04\xc5\xb2\x9e\xd9\x9e\x00\xa4\x60\x62\x40\xef\xa3\xb5\x0a\x55\x3f\xe1\x11\x4a\xc6\x80\x39\x23\x48\x2c\x07\x8c\xc0\x02\x64\x11\xdb\x90\xe3\x7a\xa1\x91\xe0\x73\x2a\x29\x67\x40\x26\x4f\x82\xeb\xf8\x29\xd3\xaa\x28\x64\x81\x7e\x47\x29\xd4\x5b\x76\x05\x09\x54\xc7\x4b\x95\x61\xe5\x8a\xce\xc6\x6d\xce\xb8\xc6\x6e\x3b\x88\x46\x93\x54\xd1\x49\x74\xd5\x14\xc5\x3a\x9e\xa9\x54\xc0\xd4\x03\x20\x52\x12\x5b\x3f\x1d\xc3\xd7\x8b\x4c\x80\x34\x61\xe6\x17\x5a\xa7\xa8\x6e\x43\x2a\x95\xd5\x5e\x2c\x4c\x5e\x96\x5f\x2f\x70\xa2\x25\x9d\xc3\x58\x21\xa1\xde\xac\x28\xe6\x20\x4d\xa9\xf2\x30\xad\xb2\x88\xae\x77\x2f\x2d\xa1\x09\x95\xaa\xaa\x86\x62\xae\xd9\x5e\x81\x92\x22\xea\xe4\xf7\x17\xd1\x52\x32\x47\xba\x71\x0c\x9d\x79\xce\xdf\x6b\x10\xcb\x26\x76\x75\x95\x12\x34\xd2\x0a\xe4\x84\xf7\x61\xa7\xa6\x56\xa7\x8e\xad\xd6\xfb\x03\xaa\x41\xa2\x8d\x31\x62\x76\xd7\x1b\x2e\x7e\x21\xb1\xa3\x71\x0c\x86\x99\xf3\x49\x4f\x83\xf7\x33\xd0\x0e\x71\x0a\x6c\xe7\xd5\x3a\xb6\x8b\x0b\x5c\x99\xa3\xdc\x6e\x25\x8f\x9c\x27\x3d\x9b\xff\x25\xd1\xc3\x80\xf4\x8a\xb5\xa1\xdc\x77\x3f\x32\x82\x3e\x6d\x13\xe0\x8c\x6b\x7c\x30\xaf\xe3\xf3\x0a\x66\x94\x51\x37\xa9\x5c\xd4\xf7\x77\x4e\xed\x71\xfa\xb7\xce\xe6\xff\xb9\xad\xa1\x7c\x91\x3e\x73\x55\x97\x90\x11\x88\x94\xba\xe8\x6f\x40\xc8\x10\x45\x90\x14\x11\xdf\x6b\xd0\xf0\x43\x24\x1e\xad\xf4\x13\x62\x31\xdc\x82\x94\x28\x86\xbf\xa8\xa4\x11\x4d\x8c\xb3\x1b\x20\x59\x2b\x2d\x80\x79\xdb\x75\x42\x53\xe0\xda\x23\x03\xf6\xa0\xb2\x13\x55\x2b\x68\xed\x52\xe2\x06\xd1\x04\x88\xef\x7c\x62\x95\xb6\xab\xc1\xa5\x7e\x3d\x64\x92\xc8\x29\x7c\x37\xce\xea\x55\x7d\x14\x1f\x39\xd0\x8d\x7d\xe4\xcf\x4e\x1f\x94\x15\xde\xf0\xea\xef\x63\x67\x03\x84\x37\x70\xa3\xb5\x29\xe2\xb2\xd3\xd8\x2e\xdc\xfd\x62\x20\xba\x8f\xe3\x2e\xb6\x0d\xf3\x80\xb4\x34\xcc\xdf\x1f\x66\x70\xb9\x02\x44\x86\xa0\x14\x88\x31\xd7\x02\xbb\x30\xf8\x9d\x7e\x59\x6d\xe3\xe1\x16\x83\xbf\x25\x5e\xe3\x95\x91\x80\x19\x5d\xb4\x9d\xad\xde\x70\x1f\x75\xb4\x7a\x31\x6a\x9a\x8e\x56\x22\x3e\x45\x9a\x3f\x00\x06\x3a\x6f\x53\x70\xd7\xb9\xe9\x66\xd5\x42\xd6\xdc\xa2\xc5\x77\x9d\x46\x20\xee\x66\xb9\x8e\x5d\x11\xf7\xbc\x7a\x1f\xff\x53\xba\x20\xf0\x88\xa8\x32\x4b\xae\xaf\xf2\x69\xa3\x2b\x23\x67\x6d\xc4\x51\x03\x27\x75\x5a\x9a\x85\xce\x03\xa4\x7c\x0e\xed\xda\x33\xff\x00\x1a\x03\x23\x2d\xa2\xe7\x0a\x12\xb4\x5c\xf9\xc6\xa7\x1d\xbc\x28\xd3\xe0\xe3\xb2\xbd\x07\x99\x15\x7a\xaf\x2b\xe9\x95\xe7\xd0\x4a\xdb\x11\xae\xa7\x73\x83\x06\x1e\xed\xc2\x86\x77\x8e\xda\xe1\x78\xb8\xe1\x9a\x29\x41\xcf\x25\x71\x1a\x64\x7e\xde\xa1\x1d\x15\xfe\xcc\xea\x28\x45\x5f\x1c\xcd\x35\xc6\x20\xe5\x4c\x17\x9b\x9c\x77\x46\x24\xd7\x7a\x9a\x15\xa3\xf1\xc9\xda\x48\x8f\x10\x3c\x4d\x09\xf0\x4f\xfd\x4e\xf1\xaf\xed\x59\x3c\x41\x69\x44\x90\xcf\x38\x3e\x60\x73\xfe\xdc\xa8\xfe\xde\x68\x66\x2f\x42\xca\x3a\x5e\xb3\x2b\xb6\xea\x26\xcb\x6c\xf7\x72\x8c\xc7\x65\x8f\xef\x35\x4a\xe8\x8c\x82\x68\x3b\x10\xe5\xc0\xae\x85\xe0\x62\xe7\x62\x4a\x21\xa5\x65\x8f\x13\x8f\x89\xd2\x71\xd3\x95\x4b\x86\x5b\x13\xd4\xce\x24\x87\xfa\xa0\xdb\x98\x3f\x7c\xbc\xef\xe6\xf6\x6f\x1a\x3f\x83\x6a\xf4\xbd\xb6\xf4\x55\xbb\x32\x47\x89\xed\x40\xeb\xa3\x3e\xb2\x7b\xd8\x90\x3f\xb4\x46\xb8\x99\xf6\xe3\xe2\xef\x83\xba\x8b\x7e\x02\xde\x0b\xbe\x2a\x28\xfe\x84\x65\xcb\xaa\x76\x16\xde\xfb\x1a\x04\x1c\x9e\xf3\xf9\x25\x13\x12\xcf\x85\x8a\x58\xcb\xe5\xde\x83\xf2\xac\xb9\xa8\x04\xe7\xcc\x3b\x72\x0f\x45\x9c\x92\x29\xb7\x2c\x36\xeb\x5a\x86\x54\x2a\xc7\x64\x89\x17\x7c\x2c\x2d\x7f\xf9\x9d\x2d\xcd\xfd\xd4\xd8\xc2\x4f\x1b\x67\x3d\xce\x94\xfd\x66\x76\x54\xfa\xdb\x04\xd8\x48\x7f\xe5\x23\x63\xa4\xf3\xec\x1a\xf2\x38\xa6\x2c\x3e\xf3\x08\xac\xb6\x61\xc4\x13\x8a\x1b\x7d\x79\xca\xdf\xfc\x1c\xae\x9c\xa0\x8f\xe5\xca\xed\x7e\xbb\x63\xfe\xbd\x76\xfe\x0b\x00\x00\xff\xff\x43\xa8\x98\xe0\x72\x2a\x00\x00")
+
+func resourcesAwswhitelistJsonBytes() ([]byte, error) {
+	return bindataRead(
+		_resourcesAwswhitelistJson,
+		"resources/AWSWhitelist.json",
+	)
+}
+
+func resourcesAwswhitelistJson() (*asset, error) {
+	bytes, err := resourcesAwswhitelistJsonBytes()
+	if err != nil {
+		return nil, err
+	}
+
+	info := bindataFileInfo{name: "resources/AWSWhitelist.json", size: 10866, mode: os.FileMode(420), modTime: time.Unix(1504302313, 0)}
+	a := &asset{bytes: bytes, info: info}
+	return a, nil
+}
+
+var _resourcesDefaultsamplingrulesJson = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xaa\xe6\x52\x50\x50\x2a\x4b\x2d\x2a\xce\xcc\xcf\x53\xb2\x52\x30\xd4\x01\xf1\x53\x52\xd3\x12\x4b\x73\x4a\x94\xac\x14\x40\xd2\x0a\x0a\x4a\x69\x99\x15\xa9\x29\xf1\x25\x89\x45\xe9\xa9\x25\x30\x55\x0a\x0a\x4a\x45\x89\x25\xa9\x4a\x56\x0a\x06\x7a\x06\xa6\x5c\x0a\x0a\xb5\x60\xbd\x45\xa5\x39\xa9\xc5\x4a\x56\x0a\xd1\x5c\x0a\x0a\xb1\x5c\xb5\x5c\x80\x00\x00\x00\xff\xff\xc9\x98\x17\x60\x61\x00\x00\x00")
+
+func resourcesDefaultsamplingrulesJsonBytes() ([]byte, error) {
+	return bindataRead(
+		_resourcesDefaultsamplingrulesJson,
+		"resources/DefaultSamplingRules.json",
+	)
+}
+
+func resourcesDefaultsamplingrulesJson() (*asset, error) {
+	bytes, err := resourcesDefaultsamplingrulesJsonBytes()
+	if err != nil {
+		return nil, err
+	}
+
+	info := bindataFileInfo{name: "resources/DefaultSamplingRules.json", size: 97, mode: os.FileMode(420), modTime: time.Unix(1504288305, 0)}
+	a := &asset{bytes: bytes, info: info}
+	return a, nil
+}
+
+var _resourcesExamplesamplingrulesJson = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x64\x90\xcd\x8e\xd4\x30\x10\x84\xef\x79\x8a\x92\x2f\x0b\xab\x6c\x98\x3d\x70\xc9\x8d\x03\x2f\x80\xb8\x21\x14\xf5\xc4\x9d\x49\x0b\xc7\xce\xda\xed\xd9\x45\x68\xde\x1d\xd9\xd9\x61\x7e\x38\xba\xab\xda\x5d\x5f\xfd\x69\x00\x73\xe4\x98\x24\x78\xd3\xe3\xb9\x2d\x6f\xcb\x13\x65\xa7\xa6\x47\x91\xeb\x20\x8d\x51\x56\xdd\x4c\xe6\x0b\xde\x1d\x88\xd9\x71\x0b\x4a\x10\x3f\xba\x6c\xd9\x62\xcf\x2e\xbc\xb6\x90\x84\xc8\x2f\x59\x22\x5b\x88\x07\xf9\xdf\x48\xb4\xac\x4e\xfc\xa1\x2e\x25\x4c\xe2\xb8\xc3\x87\xc4\xf1\x28\x23\x0f\x9e\x16\x6e\x31\xab\xae\xc3\xc2\x3a\x07\xdb\x82\xbc\x45\x8e\x6e\x58\x49\x67\x50\x64\x4c\xf2\xc6\x16\x1a\xf0\xf0\xf8\x80\x29\x44\xe8\x5c\xee\x64\xc7\xdd\x47\xd3\x6e\x51\xab\x67\x50\x8a\x07\xd6\x33\x10\x60\x22\x29\x9b\x1e\xbb\x6e\xf7\xb9\x01\x4e\x15\xb3\xe6\x30\x3d\x7e\x54\xcb\x86\xfa\x3f\xec\xd7\xb7\x92\x9b\x51\x52\x3c\xed\x29\xb1\xad\x17\x37\xd0\x0e\xdf\x2a\x4c\x49\xc7\x47\x72\x99\x74\x03\x16\xfb\x14\xa2\xe5\xd8\x42\x67\xbe\xa9\x0b\xaf\xe2\x1c\xf6\x8c\x5c\xbe\x92\x09\x3e\x78\xc6\x42\x3a\xce\xd5\x2b\x7e\x0c\x4b\xad\x89\x5f\x32\x27\xed\xf0\xbd\x50\x4a\x02\x6d\xfb\x1b\x38\x63\x9c\x79\xfc\x15\xb2\x62\xa5\x03\x77\xef\xfc\x80\x11\x5b\x62\x3f\x5f\x06\xd7\x15\x17\xe9\xf1\x22\x5d\xf5\x7d\xa7\x9c\x8b\x2f\xe3\x4f\xe7\x53\x17\xf9\xbe\xe6\xdd\x3f\xe5\xb6\x69\xe0\xd4\x00\x3f\x9b\xd3\xdf\x00\x00\x00\xff\xff\xc1\xd0\x29\x3f\x69\x02\x00\x00")
+
+func resourcesExamplesamplingrulesJsonBytes() ([]byte, error) {
+	return bindataRead(
+		_resourcesExamplesamplingrulesJson,
+		"resources/ExampleSamplingRules.json",
+	)
+}
+
+func resourcesExamplesamplingrulesJson() (*asset, error) {
+	bytes, err := resourcesExamplesamplingrulesJsonBytes()
+	if err != nil {
+		return nil, err
+	}
+
+	info := bindataFileInfo{name: "resources/ExampleSamplingRules.json", size: 617, mode: os.FileMode(420), modTime: time.Unix(1504288305, 0)}
+	a := &asset{bytes: bytes, info: info}
+	return a, nil
+}
+
+// Asset loads and returns the asset for the given name.
+// It returns an error if the asset could not be found or
+// could not be loaded.
+func Asset(name string) ([]byte, error) {
+	cannonicalName := strings.Replace(name, "\\", "/", -1)
+	if f, ok := _bindata[cannonicalName]; ok {
+		a, err := f()
+		if err != nil {
+			return nil, fmt.Errorf("Asset %s can't read by error: %v", name, err)
+		}
+		return a.bytes, nil
+	}
+	return nil, fmt.Errorf("Asset %s not found", name)
+}
+
+// MustAsset is like Asset but panics when Asset would return an error.
+// It simplifies safe initialization of global variables.
+func MustAsset(name string) []byte {
+	a, err := Asset(name)
+	if err != nil {
+		panic("asset: Asset(" + name + "): " + err.Error())
+	}
+
+	return a
+}
+
+// AssetInfo loads and returns the asset info for the given name.
+// It returns an error if the asset could not be found or
+// could not be loaded.
+func AssetInfo(name string) (os.FileInfo, error) {
+	cannonicalName := strings.Replace(name, "\\", "/", -1)
+	if f, ok := _bindata[cannonicalName]; ok {
+		a, err := f()
+		if err != nil {
+			return nil, fmt.Errorf("AssetInfo %s can't read by error: %v", name, err)
+		}
+		return a.info, nil
+	}
+	return nil, fmt.Errorf("AssetInfo %s not found", name)
+}
+
+// AssetNames returns the names of the assets.
+func AssetNames() []string {
+	names := make([]string, 0, len(_bindata))
+	for name := range _bindata {
+		names = append(names, name)
+	}
+	return names
+}
+
+// _bindata is a table, holding each asset generator, mapped to its name.
+var _bindata = map[string]func() (*asset, error){
+	"resources/AWSWhitelist.json": resourcesAwswhitelistJson,
+	"resources/DefaultSamplingRules.json": resourcesDefaultsamplingrulesJson,
+	"resources/ExampleSamplingRules.json": resourcesExamplesamplingrulesJson,
+}
+
+// AssetDir returns the file names below a certain
+// directory embedded in the file by go-bindata.
+// For example if you run go-bindata on data/... and data contains the
+// following hierarchy:
+//     data/
+//       foo.txt
+//       img/
+//         a.png
+//         b.png
+// then AssetDir("data") would return []string{"foo.txt", "img"}
+// AssetDir("data/img") would return []string{"a.png", "b.png"}
+// AssetDir("foo.txt") and AssetDir("notexist") would return an error
+// AssetDir("") will return []string{"data"}.
+func AssetDir(name string) ([]string, error) {
+	node := _bintree
+	if len(name) != 0 {
+		cannonicalName := strings.Replace(name, "\\", "/", -1)
+		pathList := strings.Split(cannonicalName, "/")
+		for _, p := range pathList {
+			node = node.Children[p]
+			if node == nil {
+				return nil, fmt.Errorf("Asset %s not found", name)
+			}
+		}
+	}
+	if node.Func != nil {
+		return nil, fmt.Errorf("Asset %s not found", name)
+	}
+	rv := make([]string, 0, len(node.Children))
+	for childName := range node.Children {
+		rv = append(rv, childName)
+	}
+	return rv, nil
+}
+
+type bintree struct {
+	Func     func() (*asset, error)
+	Children map[string]*bintree
+}
+var _bintree = &bintree{nil, map[string]*bintree{
+	"resources": &bintree{nil, map[string]*bintree{
+		"AWSWhitelist.json": &bintree{resourcesAwswhitelistJson, map[string]*bintree{}},
+		"DefaultSamplingRules.json": &bintree{resourcesDefaultsamplingrulesJson, map[string]*bintree{}},
+		"ExampleSamplingRules.json": &bintree{resourcesExamplesamplingrulesJson, map[string]*bintree{}},
+	}},
+}}
+
+// RestoreAsset restores an asset under the given directory
+func RestoreAsset(dir, name string) error {
+	data, err := Asset(name)
+	if err != nil {
+		return err
+	}
+	info, err := AssetInfo(name)
+	if err != nil {
+		return err
+	}
+	err = os.MkdirAll(_filePath(dir, filepath.Dir(name)), os.FileMode(0755))
+	if err != nil {
+		return err
+	}
+	err = ioutil.WriteFile(_filePath(dir, name), data, info.Mode())
+	if err != nil {
+		return err
+	}
+	err = os.Chtimes(_filePath(dir, name), info.ModTime(), info.ModTime())
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// RestoreAssets restores an asset under the given directory recursively
+func RestoreAssets(dir, name string) error {
+	children, err := AssetDir(name)
+	// File
+	if err != nil {
+		return RestoreAsset(dir, name)
+	}
+	// Dir
+	for _, child := range children {
+		err = RestoreAssets(dir, filepath.Join(name, child))
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func _filePath(dir, name string) string {
+	cannonicalName := strings.Replace(name, "\\", "/", -1)
+	return filepath.Join(append([]string{dir}, strings.Split(cannonicalName, "/")...)...)
+}
+
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/ctxmissing/context_missing.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/ctxmissing/context_missing.go
new file mode 100644
index 00000000..487d5396
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/ctxmissing/context_missing.go
@@ -0,0 +1,18 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+// Package ctxmissing provides control over
+// the behavior of the X-Ray SDK when subsegments
+// are created without a provided parent segment.
+package ctxmissing
+
+// Strategy provides an interface for
+// implementing context missing strategies.
+type Strategy interface {
+	ContextMissing(v interface{})
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/ctxmissing/default_context_missing.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/ctxmissing/default_context_missing.go
new file mode 100644
index 00000000..6983497c
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/ctxmissing/default_context_missing.go
@@ -0,0 +1,54 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package ctxmissing
+
+import (
+	log "github.com/cihub/seelog"
+)
+
+// RuntimeErrorStrategy provides the AWS_XRAY_CONTEXT_MISSING
+// environment variable value for enabling the runtime error
+// context missing strategy (panic).
+var RuntimeErrorStrategy = "RUNTIME_ERROR"
+
+// LogErrorStrategy provides the AWS_XRAY_CONTEXT_MISSING
+// environment variable value for enabling the log error
+// context missing strategy.
+var LogErrorStrategy = "LOG_ERROR"
+
+// DefaultRuntimeErrorStrategy implements the
+// runtime error context missing strategy.
+type DefaultRuntimeErrorStrategy struct{}
+
+// DefaultLogErrorStrategy implements the
+// log error context missing strategy.
+type DefaultLogErrorStrategy struct{}
+
+// NewDefaultRuntimeErrorStrategy initializes
+// an instance of DefaultRuntimeErrorStrategy.
+func NewDefaultRuntimeErrorStrategy() *DefaultRuntimeErrorStrategy {
+	return &DefaultRuntimeErrorStrategy{}
+}
+
+// NewDefaultLogErrorStrategy initializes
+// an instance of DefaultLogErrorStrategy.
+func NewDefaultLogErrorStrategy() *DefaultLogErrorStrategy {
+	return &DefaultLogErrorStrategy{}
+}
+
+// ContextMissing panics when the segment context is missing.
+func (dr *DefaultRuntimeErrorStrategy) ContextMissing(v interface{}) {
+	panic(v)
+}
+
+// ContextMissing logs an error message when the
+// segment context is missing.
+func (dl *DefaultLogErrorStrategy) ContextMissing(v interface{}) {
+	log.Errorf("Suppressing AWS X-Ray context missing panic: %v", v)
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/exception/default_exception_formatting_strategy.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/exception/default_exception_formatting_strategy.go
new file mode 100644
index 00000000..9636a6eb
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/exception/default_exception_formatting_strategy.go
@@ -0,0 +1,202 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package exception
+
+import (
+	"bytes"
+	"crypto/rand"
+	"fmt"
+	"runtime"
+	"strings"
+
+	"github.com/pkg/errors"
+)
+
+// StackTracer is an interface for implementing StackTrace method.
+type StackTracer interface {
+	StackTrace() []uintptr
+}
+
+// Exception provides the shape for unmarshaling an exception.
+type Exception struct {
+	ID      string  `json:"id,omitempty"`
+	Type    string  `json:"type,omitempty"`
+	Message string  `json:"message,omitempty"`
+	Stack   []Stack `json:"stack,omitempty"`
+}
+
+// Stack provides the shape for unmarshaling an stack.
+type Stack struct {
+	Path  string `json:"path,omitempty"`
+	Line  int    `json:"line,omitempty"`
+	Label string `json:"label,omitempty"`
+}
+
+// MultiError is a type for a slice of error.
+type MultiError []error
+
+// Error returns a string format of concatenating multiple errors.
+func (e MultiError) Error() string {
+	var buf bytes.Buffer
+	fmt.Fprintf(&buf, "%d errors occurred:\n", len(e))
+	for _, err := range e {
+		buf.WriteString("* ")
+		buf.WriteString(err.Error())
+		buf.WriteByte('\n')
+	}
+	return buf.String()
+}
+
+var defaultErrorFrameCount = 32
+
+// DefaultFormattingStrategy is the default implementation of
+// the ExceptionFormattingStrategy and has a configurable frame count.
+type DefaultFormattingStrategy struct {
+	FrameCount int
+}
+
+// NewDefaultFormattingStrategy initializes DefaultFormattingStrategy
+// with default value of frame count.
+func NewDefaultFormattingStrategy() (*DefaultFormattingStrategy, error) {
+	return &DefaultFormattingStrategy{FrameCount: defaultErrorFrameCount}, nil
+}
+
+// NewDefaultFormattingStrategyWithDefinedErrorFrameCount initializes
+// DefaultFormattingStrategy with customer defined frame count.
+func NewDefaultFormattingStrategyWithDefinedErrorFrameCount(frameCount int) (*DefaultFormattingStrategy, error) {
+	if frameCount > 32 || frameCount < 0 {
+		return nil, errors.New("frameCount must be a non-negative integer and less than 32")
+	}
+	return &DefaultFormattingStrategy{FrameCount: frameCount}, nil
+}
+
+// Error returns the value of XRayError by given error message.
+func (dEFS *DefaultFormattingStrategy) Error(message string) *XRayError {
+	s := make([]uintptr, dEFS.FrameCount)
+	n := runtime.Callers(2, s)
+	s = s[:n]
+
+	return &XRayError{
+		Type:    "error",
+		Message: message,
+		Stack:   s,
+	}
+}
+
+// Errorf formats according to a format specifier and returns value of XRayError.
+func (dEFS *DefaultFormattingStrategy) Errorf(formatString string, args ...interface{}) *XRayError {
+	e := dEFS.Error(fmt.Sprintf(formatString, args...))
+	e.Stack = e.Stack[1:]
+	return e
+}
+
+// Panic records error type as panic in segment and returns value of XRayError.
+func (dEFS *DefaultFormattingStrategy) Panic(message string) *XRayError {
+	e := dEFS.Error(message)
+	e.Type = "panic"
+	e.Stack = e.Stack[4:]
+	return e
+}
+
+// Panicf formats according to a format specifier and returns value of XRayError.
+func (dEFS *DefaultFormattingStrategy) Panicf(formatString string, args ...interface{}) *XRayError {
+	e := dEFS.Panic(fmt.Sprintf(formatString, args...))
+	e.Stack = e.Stack[1:]
+	return e
+}
+
+// ExceptionFromError takes an error and returns value of Exception
+func (dEFS *DefaultFormattingStrategy) ExceptionFromError(err error) Exception {
+	e := Exception{
+		ID:      newExceptionID(),
+		Type:    "error",
+		Message: err.Error(),
+	}
+
+	if err, ok := err.(*XRayError); ok {
+		e.Type = err.Type
+	}
+
+	var s []uintptr
+
+	// This is our publicly supported interface for passing along stack traces
+	if err, ok := err.(StackTracer); ok {
+		s = err.StackTrace()
+	}
+
+	// We also accept github.com/pkg/errors style stack traces for ease of use
+	if err, ok := err.(interface {
+		StackTrace() errors.StackTrace
+	}); ok {
+		for _, frame := range err.StackTrace() {
+			s = append(s, uintptr(frame))
+		}
+	}
+
+	if s == nil {
+		s = make([]uintptr, dEFS.FrameCount)
+		n := runtime.Callers(5, s)
+		s = s[:n]
+	}
+
+	e.Stack = convertStack(s)
+	return e
+}
+
+func newExceptionID() string {
+	var r [8]byte
+	_, err := rand.Read(r[:])
+	if err != nil {
+		panic(err)
+	}
+	return fmt.Sprintf("%02x", r)
+}
+
+func convertStack(s []uintptr) []Stack {
+	var r []Stack
+	frames := runtime.CallersFrames(s)
+
+	d := true
+	for frame, more := frames.Next(); d; frame, more = frames.Next() {
+		f := &Stack{}
+		f.Path, f.Line, f.Label = parseFrame(frame)
+		r = append(r, *f)
+		d = more
+	}
+	return r
+}
+
+func parseFrame(frame runtime.Frame) (string, int, string) {
+	path, line, label := frame.File, frame.Line, frame.Function
+
+	// Strip GOPATH from path by counting the number of seperators in label & path
+	// For example:
+	//   GOPATH = /home/user
+	//   path   = /home/user/src/pkg/sub/file.go
+	//   label  = pkg/sub.Type.Method
+	// We want to set path to:
+	//    pkg/sub/file.go
+	i := len(path)
+	for n, g := 0, strings.Count(label, "/")+2; n < g; n++ {
+		i = strings.LastIndex(path[:i], "/")
+		if i == -1 {
+			// Something went wrong and path has less seperators than we expected
+			// Abort and leave i as -1 to counteract the +1 below
+			break
+		}
+	}
+	path = path[i+1:] // Trim the initial /
+
+	// Strip the path from the function name as it's already in the path
+	label = label[strings.LastIndex(label, "/")+1:]
+	// Likewise strip the package name
+	label = label[strings.Index(label, ".")+1:]
+
+	return path, line, label
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/exception/exception_formatting_strategy.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/exception/exception_formatting_strategy.go
new file mode 100644
index 00000000..d240e23b
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/exception/exception_formatting_strategy.go
@@ -0,0 +1,18 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package exception
+
+// FormattingStrategy provides an interface for implementing methods that format errors and exceptions.
+type FormattingStrategy interface {
+	Error(message string) *XRayError
+	Errorf(formatString string, args ...interface{}) *XRayError
+	Panic(message string) *XRayError
+	Panicf(formatString string, args ...interface{}) *XRayError
+	ExceptionFromError(err error) Exception
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/exception/xray_error.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/exception/xray_error.go
new file mode 100644
index 00000000..a16e2a1d
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/exception/xray_error.go
@@ -0,0 +1,27 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package exception
+
+// XRayError records error type, message,
+// and a slice of stack frame pointers.
+type XRayError struct {
+	Type    string
+	Message string
+	Stack   []uintptr
+}
+
+// Error returns the value of error message.
+func (e *XRayError) Error() string {
+	return e.Message
+}
+
+// StackTrace returns a slice of integer pointers.
+func (e *XRayError) StackTrace() []uintptr {
+	return e.Stack
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/localized.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/localized.go
new file mode 100644
index 00000000..301fcd45
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/localized.go
@@ -0,0 +1,74 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package sampling
+
+import (
+	"github.com/aws/aws-xray-sdk-go/resources"
+	log "github.com/cihub/seelog"
+)
+
+// LocalizedStrategy makes trace sampling decisions based on
+// a set of rules provided in a local JSON file. Trace sampling
+// decisions are made by the root node in the trace. If a
+// sampling decision is made by the root service, it will be passed
+// to downstream services through the trace header.
+type LocalizedStrategy struct {
+	manifest *RuleManifest
+}
+
+// NewLocalizedStrategy initializes an instance of LocalizedStrategy
+// with the default trace sampling rules. The default rules sample
+// the first request per second, and 5% of requests thereafter.
+func NewLocalizedStrategy() (*LocalizedStrategy, error) {
+	bytes, err := resources.Asset("resources/DefaultSamplingRules.json")
+	if err != nil {
+		return nil, err
+	}
+	manifest, err := ManifestFromJSONBytes(bytes)
+	if err != nil {
+		return nil, err
+	}
+	return &LocalizedStrategy{manifest: manifest}, nil
+}
+
+// NewLocalizedStrategyFromFilePath initializes an instance of
+// LocalizedStrategy using a custom ruleset found at the filepath fp.
+func NewLocalizedStrategyFromFilePath(fp string) (*LocalizedStrategy, error) {
+	manifest, err := ManifestFromFilePath(fp)
+	if err != nil {
+		return nil, err
+	}
+	return &LocalizedStrategy{manifest: manifest}, nil
+}
+
+// NewLocalizedStrategyFromJSONBytes initializes an instance of
+// LocalizedStrategy using a custom ruleset provided in the json bytes b.
+func NewLocalizedStrategyFromJSONBytes(b []byte) (*LocalizedStrategy, error) {
+	manifest, err := ManifestFromJSONBytes(b)
+	if err != nil {
+		return nil, err
+	}
+	return &LocalizedStrategy{manifest: manifest}, nil
+}
+
+// ShouldTrace consults the LocalizedStrategy's rule set to determine
+// if the given request should be traced or not.
+func (lss *LocalizedStrategy) ShouldTrace(serviceName string, path string, method string) bool {
+	log.Tracef("Determining ShouldTrace decision for:\n\tserviceName: %s\n\tpath: %s\n\tmethod: %s", serviceName, path, method)
+	if nil != lss.manifest.Rules {
+		for _, r := range lss.manifest.Rules {
+			if r.AppliesTo(serviceName, path, method) {
+				log.Tracef("Applicable rule:\n\tfixed_target: %d\n\trate: %f\n\tservice_name: %s\n\turl_path: %s\n\thttp_method: %s", r.FixedTarget, r.Rate, r.ServiceName, r.URLPath, r.HTTPMethod)
+				return r.Sample()
+			}
+		}
+	}
+	log.Tracef("Default rule applies:\n\tfixed_target: %d\n\trate: %f", lss.manifest.Default.FixedTarget, lss.manifest.Default.Rate)
+	return lss.manifest.Default.Sample()
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/reservoir.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/reservoir.go
new file mode 100644
index 00000000..8d2fc755
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/reservoir.go
@@ -0,0 +1,81 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package sampling
+
+import (
+	"fmt"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+var maxRate uint64 = 1e8
+
+// Reservoir allows a specified amount of `Take()`s per second.
+// Support for atomic operations on uint64 is required.
+// More information: https://golang.org/pkg/sync/atomic/#pkg-note-BUG
+type Reservoir struct {
+	maskedCounter uint64
+	perSecond     uint64
+	mutex         sync.Mutex // don't use embedded struct to ensure 64 bit alignment for maskedCounter.
+}
+
+// NewReservoir creates a new reservoir with a specified perSecond
+// sampling capacity. The maximum supported sampling capacity per
+// second is currently 100,000,000. An error is returned if the
+// desired capacity is greater than this maximum value.
+func NewReservoir(perSecond uint64) (*Reservoir, error) {
+	if perSecond >= maxRate {
+		return nil, fmt.Errorf("desired sampling capacity of %d is greater than maximum supported rate %d", perSecond, maxRate)
+	}
+	return &Reservoir{
+		maskedCounter: 0,
+		perSecond:     perSecond,
+	}, nil
+}
+
+// Take returns true when the reservoir has remaining sampling
+// capacity for the current epoch. Take returns false when the
+// reservoir has no remaining sampling capacity for the current
+// epoch. The sampling capacity decrements by one each time
+// Take returns true.
+func (r *Reservoir) Take() bool {
+	now := uint64(time.Now().Unix())
+	counterNewVal := atomic.AddUint64(&r.maskedCounter, 1)
+	previousTimestamp := extractTime(counterNewVal)
+
+	if previousTimestamp != now {
+		r.mutex.Lock()
+		beforeUpdate := atomic.LoadUint64(&r.maskedCounter)
+		timestampBeforeUpdate := extractTime(beforeUpdate)
+
+		if timestampBeforeUpdate != now {
+			valueToSet := timestampToCounter(now)
+			atomic.StoreUint64(&r.maskedCounter, valueToSet)
+		}
+
+		counterNewVal = atomic.AddUint64(&r.maskedCounter, 1)
+		r.mutex.Unlock()
+	}
+
+	newCounterValue := extractCounter(counterNewVal)
+	return newCounterValue <= r.perSecond
+}
+
+func extractTime(maskedCounter uint64) uint64 {
+	return maskedCounter / maxRate
+}
+
+func extractCounter(maskedCounter uint64) uint64 {
+	return maskedCounter % maxRate
+}
+
+func timestampToCounter(timestamp uint64) uint64 {
+	return timestamp * maxRate
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/sampling_rule.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/sampling_rule.go
new file mode 100644
index 00000000..ab3fb88d
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/sampling_rule.go
@@ -0,0 +1,39 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package sampling
+
+import (
+	"math/rand"
+
+	"github.com/aws/aws-xray-sdk-go/pattern"
+)
+
+// Rule represents a single entry in a sampling ruleset.
+type Rule struct {
+	ServiceName string  `json:"service_name"`
+	HTTPMethod  string  `json:"http_method"`
+	URLPath     string  `json:"url_path"`
+	FixedTarget uint64  `json:"fixed_target"`
+	Rate        float64 `json:"rate"`
+	reservoir   *Reservoir
+}
+
+// AppliesTo returns true when the rule applies to the given parameters
+func (sr *Rule) AppliesTo(serviceName string, path string, method string) bool {
+	return pattern.WildcardMatchCaseInsensitive(sr.ServiceName, serviceName) && pattern.WildcardMatchCaseInsensitive(sr.URLPath, path) && pattern.WildcardMatchCaseInsensitive(sr.HTTPMethod, method)
+}
+
+// Sample returns true when the rule's reservoir is not full or
+// when a randomly generated float is less than the rule's rate
+func (sr *Rule) Sample() bool {
+	if sr.reservoir.Take() {
+		return true
+	}
+	return rand.Float64() < sr.Rate
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/sampling_rule_manifest.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/sampling_rule_manifest.go
new file mode 100644
index 00000000..e604d30d
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/sampling_rule_manifest.go
@@ -0,0 +1,93 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package sampling
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/ioutil"
+)
+
+// RuleManifest represents a full sampling ruleset, with a list of
+// custom rules and default values for incoming requests that do
+// not match any of the provided rules.
+type RuleManifest struct {
+	Version int     `json:"version"`
+	Default *Rule   `json:"default"`
+	Rules   []*Rule `json:"rules"`
+}
+
+// ManifestFromFilePath creates a sampling ruleset from a given filepath fp.
+func ManifestFromFilePath(fp string) (*RuleManifest, error) {
+	b, err := ioutil.ReadFile(fp)
+	if err == nil {
+		s, e := ManifestFromJSONBytes(b)
+		if e != nil {
+			return nil, e
+		}
+		err = processManifest(s)
+		if err != nil {
+			return nil, err
+		}
+		return s, nil
+	}
+	return nil, err
+}
+
+// ManifestFromJSONBytes creates a sampling ruleset from given JSON bytes b.
+func ManifestFromJSONBytes(b []byte) (*RuleManifest, error) {
+	s := &RuleManifest{}
+	err := json.Unmarshal(b, s)
+	if err != nil {
+		return nil, err
+	}
+	err = processManifest(s)
+	if err != nil {
+		return nil, err
+	}
+	return s, nil
+}
+
+// processManifest returns the provided manifest if valid,
+// or an error if the provided manifest is invalid.
+func processManifest(srm *RuleManifest) error {
+	if nil == srm {
+		return errors.New("sampling rule manifest must not be nil")
+	}
+	if 1 != srm.Version {
+		return fmt.Errorf("sampling rule manifest version %d not supported", srm.Version)
+	}
+	if nil == srm.Default {
+		return errors.New("sampling rule manifest must include a default rule")
+	}
+	if "" != srm.Default.URLPath || "" != srm.Default.ServiceName || "" != srm.Default.HTTPMethod {
+		return errors.New("the default rule must not specify values for url_path, service_name, or http_method")
+	}
+	if srm.Default.FixedTarget < 0 || srm.Default.Rate < 0 {
+		return errors.New("the default rule must specify non-negative values for fixed_target and rate")
+	}
+
+	res, err := NewReservoir(srm.Default.FixedTarget)
+	if err != nil {
+		return err
+	}
+	srm.Default.reservoir = res
+
+	if srm.Rules != nil {
+		for _, r := range srm.Rules {
+			res, err := NewReservoir(r.FixedTarget)
+			if err != nil {
+				return err
+			}
+			r.reservoir = res
+		}
+	}
+	return nil
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/sampling_strategy.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/sampling_strategy.go
new file mode 100644
index 00000000..583dfa39
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/sampling_strategy.go
@@ -0,0 +1,14 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package sampling
+
+// Strategy provides an interface for implementing trace sampling strategies.
+type Strategy interface {
+	ShouldTrace(serviceName string, path string, method string) bool
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/aws.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/aws.go
new file mode 100644
index 00000000..de19fc30
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/aws.go
@@ -0,0 +1,402 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"net/http/httptrace"
+	"reflect"
+	"strings"
+	"unicode"
+
+	"github.com/aws/aws-sdk-go/aws/client"
+	"github.com/aws/aws-sdk-go/aws/request"
+	"github.com/aws/aws-xray-sdk-go/resources"
+	log "github.com/cihub/seelog"
+)
+
+type jsonMap struct {
+	object interface{}
+}
+
+const (
+	requestKeyword = iota
+	responseKeyword
+)
+
+func beginSubsegment(r *request.Request, name string) {
+	ctx, _ := BeginSubsegment(r.HTTPRequest.Context(), name)
+	r.HTTPRequest = r.HTTPRequest.WithContext(ctx)
+}
+
+func endSubsegment(r *request.Request) {
+	seg := GetSegment(r.HTTPRequest.Context())
+	seg.Close(r.Error)
+	r.HTTPRequest = r.HTTPRequest.WithContext(context.WithValue(r.HTTPRequest.Context(), ContextKey, seg.parent))
+}
+
+var xRayBeforeValidateHandler = request.NamedHandler{
+	Name: "XRayBeforeValidateHandler",
+	Fn: func(r *request.Request) {
+		ctx, opseg := BeginSubsegment(r.HTTPRequest.Context(), r.ClientInfo.ServiceName)
+		opseg.Namespace = "aws"
+		marshalctx, _ := BeginSubsegment(ctx, "marshal")
+
+		r.HTTPRequest = r.HTTPRequest.WithContext(marshalctx)
+		r.HTTPRequest.Header.Set("x-amzn-trace-id", opseg.DownstreamHeader().String())
+	},
+}
+
+var xRayAfterBuildHandler = request.NamedHandler{
+	Name: "XRayAfterBuildHandler",
+	Fn: func(r *request.Request) {
+		endSubsegment(r)
+	},
+}
+
+var xRayBeforeSignHandler = request.NamedHandler{
+	Name: "XRayBeforeSignHandler",
+	Fn: func(r *request.Request) {
+		ctx, _ := BeginSubsegment(r.HTTPRequest.Context(), fmt.Sprintf("attempt_%d", (r.RetryCount+1)))
+
+		ct, _ := NewClientTrace(ctx)
+		r.HTTPRequest = r.HTTPRequest.WithContext(httptrace.WithClientTrace(ctx, ct.httpTrace))
+	},
+}
+
+var xRayAfterSignHandler = request.NamedHandler{
+	Name: "XRayAfterSignHandler",
+	Fn: func(r *request.Request) {
+		endSubsegment(r)
+	},
+}
+
+var xRayBeforeSendHandler = request.NamedHandler{
+	Name: "XRayBeforeSendHandler",
+	Fn: func(r *request.Request) {
+	},
+}
+
+var xRayAfterSendHandler = request.NamedHandler{
+	Name: "XRayAfterSendHandler",
+	Fn: func(r *request.Request) {
+		endSubsegment(r)
+	},
+}
+
+var xRayBeforeUnmarshalHandler = request.NamedHandler{
+	Name: "XRayBeforeUnmarshalHandler",
+	Fn: func(r *request.Request) {
+		endSubsegment(r) // end attempt_x subsegment
+		beginSubsegment(r, "unmarshal")
+	},
+}
+
+var xRayAfterUnmarshalHandler = request.NamedHandler{
+	Name: "XRayAfterUnmarshalHandler",
+	Fn: func(r *request.Request) {
+		endSubsegment(r)
+	},
+}
+
+var xRayBeforeRetryHandler = request.NamedHandler{
+	Name: "XRayBeforeRetryHandler",
+	Fn: func(r *request.Request) {
+		endSubsegment(r) // end attempt_x subsegment
+		ctx, _ := BeginSubsegment(r.HTTPRequest.Context(), "wait")
+
+		r.HTTPRequest = r.HTTPRequest.WithContext(ctx)
+	},
+}
+
+var xRayAfterRetryHandler = request.NamedHandler{
+	Name: "XRayAfterRetryHandler",
+	Fn: func(r *request.Request) {
+		endSubsegment(r)
+	},
+}
+
+func pushHandlers(c *client.Client) {
+	c.Handlers.Validate.PushFrontNamed(xRayBeforeValidateHandler)
+	c.Handlers.Build.PushBackNamed(xRayAfterBuildHandler)
+	c.Handlers.Sign.PushFrontNamed(xRayBeforeSignHandler)
+	c.Handlers.Unmarshal.PushFrontNamed(xRayBeforeUnmarshalHandler)
+	c.Handlers.Unmarshal.PushBackNamed(xRayAfterUnmarshalHandler)
+	c.Handlers.Retry.PushFrontNamed(xRayBeforeRetryHandler)
+	c.Handlers.AfterRetry.PushBackNamed(xRayAfterRetryHandler)
+}
+
+// AWS adds X-Ray tracing to an AWS client.
+func AWS(c *client.Client) {
+	if c == nil {
+		panic("Please initialize the provided AWS client before passing to the AWS() method.")
+	}
+	pushHandlers(c)
+	c.Handlers.Complete.PushFrontNamed(xrayCompleteHandler(""))
+}
+
+// AWSWithWhitelist allows a custom parameter whitelist JSON file to be defined.
+func AWSWithWhitelist(c *client.Client, filename string) {
+	if c == nil {
+		panic("Please initialize the provided AWS client before passing to the AWSWithWhitelist() method.")
+	}
+	pushHandlers(c)
+	c.Handlers.Complete.PushFrontNamed(xrayCompleteHandler(filename))
+}
+
+func xrayCompleteHandler(filename string) request.NamedHandler {
+	whitelistJSON := parseWhitelistJSON(filename)
+	whitelist := &jsonMap{}
+	err := json.Unmarshal(whitelistJSON, &whitelist.object)
+	if err != nil {
+		panic(err)
+	}
+
+	return request.NamedHandler{
+		Name: "XRayCompleteHandler",
+		Fn: func(r *request.Request) {
+			curseg := GetSegment(r.HTTPRequest.Context())
+
+			for curseg != nil && curseg.Namespace != "aws" {
+				curseg.Close(nil)
+				curseg = curseg.parent
+			}
+			if curseg == nil {
+				return
+			}
+
+			opseg := curseg
+
+			opseg.Lock()
+			for k, v := range extractRequestParameters(r, whitelist) {
+				opseg.GetAWS()[strings.ToLower(addUnderScoreBetweenWords(k))] = v
+			}
+			for k, v := range extractResponseParameters(r, whitelist) {
+				opseg.GetAWS()[strings.ToLower(addUnderScoreBetweenWords(k))] = v
+			}
+
+			opseg.GetAWS()["region"] = r.ClientInfo.SigningRegion
+			opseg.GetAWS()["operation"] = r.Operation.Name
+			opseg.GetAWS()["request_id"] = r.RequestID
+			opseg.GetAWS()["retries"] = r.RetryCount
+
+			if r.HTTPResponse != nil {
+				opseg.GetHTTP().GetResponse().Status = r.HTTPResponse.StatusCode
+				opseg.GetHTTP().GetResponse().ContentLength = int(r.HTTPResponse.ContentLength)
+			}
+
+			if request.IsErrorThrottle(r.Error) {
+				opseg.Throttle = true
+			}
+
+			opseg.Unlock()
+			opseg.Close(r.Error)
+		},
+	}
+}
+
+func parseWhitelistJSON(filename string) []byte {
+	if filename != "" {
+		readBytes, err := ioutil.ReadFile(filename)
+		if err != nil {
+			log.Errorf("Error occurred while reading customized AWS whitelist JSON file. %v \nReverting to default AWS whitelist JSON file.", err)
+		} else {
+			return readBytes
+		}
+	}
+
+	defaultBytes, err := resources.Asset("resources/AWSWhitelist.json")
+	if err != nil {
+		panic(err)
+	}
+	return defaultBytes
+}
+
+func keyValue(r interface{}, tag string) interface{} {
+	v := reflect.ValueOf(r)
+	if v.Kind() == reflect.Ptr {
+		v = v.Elem()
+	}
+	if v.Kind() != reflect.Struct {
+		log.Errorf("keyValue only accepts structs; got %T", v)
+	}
+	typ := v.Type()
+	for i := 1; i < v.NumField(); i++ {
+		if typ.Field(i).Name == tag {
+			return v.Field(i).Interface()
+		}
+	}
+	return nil
+}
+
+func addUnderScoreBetweenWords(name string) string {
+	var buffer bytes.Buffer
+	for i, char := range name {
+		if unicode.IsUpper(char) && i != 0 {
+			buffer.WriteRune('_')
+		}
+		buffer.WriteRune(char)
+	}
+	return buffer.String()
+}
+
+func (j *jsonMap) data() interface{} {
+	if j == nil {
+		return nil
+	}
+	return j.object
+}
+
+func (j *jsonMap) search(keys ...string) *jsonMap {
+	var object interface{}
+	object = j.data()
+
+	for target := 0; target < len(keys); target++ {
+		if mmap, ok := object.(map[string]interface{}); ok {
+			object, ok = mmap[keys[target]]
+			if !ok {
+				return nil
+			}
+		} else {
+			return nil
+		}
+	}
+	return &jsonMap{object}
+}
+
+func (j *jsonMap) children() ([]interface{}, error) {
+	if slice, ok := j.data().([]interface{}); ok {
+		return slice, nil
+	}
+	return nil, errors.New("cannot get corresponding items for given aws whitelisting json file")
+}
+
+func (j *jsonMap) childrenMap() (map[string]interface{}, error) {
+	if mmap, ok := j.data().(map[string]interface{}); ok {
+		return mmap, nil
+	}
+	return nil, errors.New("cannot get corresponding items for given aws whitelisting json file")
+}
+
+func extractRequestParameters(r *request.Request, whitelist *jsonMap) map[string]interface{} {
+	valueMap := make(map[string]interface{})
+
+	extractParameters("request_parameters", requestKeyword, r, whitelist, valueMap)
+	extractDescriptors("request_descriptors", requestKeyword, r, whitelist, valueMap)
+
+	return valueMap
+}
+
+func extractResponseParameters(r *request.Request, whitelist *jsonMap) map[string]interface{} {
+	valueMap := make(map[string]interface{})
+
+	extractParameters("response_parameters", responseKeyword, r, whitelist, valueMap)
+	extractDescriptors("response_descriptors", responseKeyword, r, whitelist, valueMap)
+
+	return valueMap
+}
+
+func extractParameters(whitelistKey string, rType int, r *request.Request, whitelist *jsonMap, valueMap map[string]interface{}) {
+	params := whitelist.search("services", r.ClientInfo.ServiceName, "operations", r.Operation.Name, whitelistKey)
+	if params != nil {
+		children, err := params.children()
+		if err != nil {
+			log.Errorf("failed to get values for aws attribute: %v", err)
+			return
+		}
+		for _, child := range children {
+			if child != nil {
+				var value interface{}
+				if rType == requestKeyword {
+					value = keyValue(r.Params, child.(string))
+				} else if rType == responseKeyword {
+					value = keyValue(r.Data, child.(string))
+				}
+				if (value != reflect.Value{}) {
+					valueMap[child.(string)] = value
+				}
+			}
+		}
+	}
+}
+
+func extractDescriptors(whitelistKey string, rType int, r *request.Request, whitelist *jsonMap, valueMap map[string]interface{}) {
+	responseDtr := whitelist.search("services", r.ClientInfo.ServiceName, "operations", r.Operation.Name, whitelistKey)
+	if responseDtr != nil {
+		items, err := responseDtr.childrenMap()
+		if err != nil {
+			log.Errorf("failed to get values for aws attribute: %v", err)
+			return
+		}
+		for k := range items {
+			descriptorMap, _ := whitelist.search("services", r.ClientInfo.ServiceName, "operations", r.Operation.Name, whitelistKey, k).childrenMap()
+			if rType == requestKeyword {
+				insertDescriptorValuesIntoMap(k, r.Params, descriptorMap, valueMap)
+			} else if rType == responseKeyword {
+				insertDescriptorValuesIntoMap(k, r.Data, descriptorMap, valueMap)
+			}
+		}
+	}
+}
+
+func descriptorType(descriptorMap map[string]interface{}) string {
+	var typeValue string
+	if (descriptorMap["map"] != nil) && (descriptorMap["get_keys"] != nil) {
+		typeValue = "map"
+	} else if (descriptorMap["list"] != nil) && (descriptorMap["get_count"] != nil) {
+		typeValue = "list"
+	} else if descriptorMap["value"] != nil {
+		typeValue = "value"
+	} else {
+		log.Error("Missing keys in request / response descriptors in AWS whitelist JSON file.")
+	}
+	return typeValue
+}
+
+func insertDescriptorValuesIntoMap(key string, data interface{}, descriptorMap map[string]interface{}, valueMap map[string]interface{}) {
+	descriptorType := descriptorType(descriptorMap)
+	if descriptorType == "map" {
+		var keySlice []interface{}
+		m := keyValue(data, key)
+		val := reflect.ValueOf(m)
+		if val.Kind() == reflect.Map {
+			for _, key := range val.MapKeys() {
+				keySlice = append(keySlice, key.Interface())
+			}
+		}
+		if descriptorMap["rename_to"] != nil {
+			valueMap[descriptorMap["rename_to"].(string)] = keySlice
+		} else {
+			valueMap[strings.ToLower(key)] = keySlice
+		}
+	} else if descriptorType == "list" {
+		var count int
+		l := keyValue(data, key)
+		val := reflect.ValueOf(l)
+		count = val.Len()
+
+		if descriptorMap["rename_to"] != nil {
+			valueMap[descriptorMap["rename_to"].(string)] = count
+		} else {
+			valueMap[strings.ToLower(key)] = count
+		}
+	} else if descriptorType == "value" {
+		val := keyValue(data, key)
+		if descriptorMap["rename_to"] != nil {
+			valueMap[descriptorMap["rename_to"].(string)] = val
+		} else {
+			valueMap[strings.ToLower(key)] = val
+		}
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/capture.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/capture.go
new file mode 100644
index 00000000..f23cc476
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/capture.go
@@ -0,0 +1,56 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+import (
+	"context"
+	"fmt"
+)
+
+// Capture traces the provided synchronous function by
+// beginning and closing a subsegment around its execution.
+func Capture(ctx context.Context, name string, fn func(context.Context) error) (err error) {
+	c, seg := BeginSubsegment(ctx, name)
+
+	defer func() {
+		if seg != nil {
+			seg.Close(err)
+
+		} else {
+			privateCfg.ContextMissingStrategy().ContextMissing(fmt.Sprintf("failed to end subsegment: subsegment '%v' cannot be found.", name))
+		}
+	}()
+
+	defer func() {
+		if p := recover(); p != nil {
+			err = privateCfg.ExceptionFormattingStrategy().Panicf("%v", p)
+			panic(p)
+		}
+	}()
+
+	if c == nil && seg == nil {
+		err = fn(ctx)
+	} else {
+		err = fn(c)
+	}
+
+	return err
+}
+
+// CaptureAsync traces an arbitrary code segment within a goroutine.
+// Use CaptureAsync instead of manually calling Capture within a goroutine
+// to ensure the segment is flushed properly.
+func CaptureAsync(ctx context.Context, name string, fn func(context.Context) error) {
+	started := make(chan struct{})
+	go Capture(ctx, name, func(ctx context.Context) error {
+		close(started)
+		return fn(ctx)
+	})
+	<-started
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/client.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/client.go
new file mode 100644
index 00000000..e9844654
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/client.go
@@ -0,0 +1,99 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptrace"
+	"strconv"
+	log "github.com/cihub/seelog"
+)
+
+// Client creates a shallow copy of the provided http client,
+// defaulting to http.DefaultClient, with roundtripper wrapped
+// with xray.RoundTripper.
+func Client(c *http.Client) *http.Client {
+	if c == nil {
+		c = http.DefaultClient
+	}
+	transport := c.Transport
+	if transport == nil {
+		transport = http.DefaultTransport
+	}
+	return &http.Client{
+		Transport:     RoundTripper(transport),
+		CheckRedirect: c.CheckRedirect,
+		Jar:           c.Jar,
+		Timeout:       c.Timeout,
+	}
+}
+
+// RoundTripper wraps the provided http roundtripper with xray.Capture,
+// sets HTTP-specific xray fields, and adds the trace header to the outbound request.
+func RoundTripper(rt http.RoundTripper) http.RoundTripper {
+	return &roundtripper{rt}
+}
+
+type roundtripper struct {
+	Base http.RoundTripper
+}
+
+// RoundTrip wraps a single HTTP transaction and add corresponding information into a subsegment.
+func (rt *roundtripper) RoundTrip(r *http.Request) (*http.Response, error) {
+	var resp *http.Response
+	err := Capture(r.Context(), r.Host, func(ctx context.Context) error {
+		var err error
+		seg := GetSegment(ctx)
+		if seg == nil {
+			resp, err = rt.Base.RoundTrip(r)
+			log.Warnf("failed to record HTTP transaction: segment cannot be found.")
+			return err
+		}
+		
+		ct, e := NewClientTrace(ctx)
+		if e != nil {
+			return e
+		}
+		r = r.WithContext(httptrace.WithClientTrace(ctx, ct.httpTrace))
+
+		seg.Lock()
+		seg.Namespace = "remote"
+		seg.GetHTTP().GetRequest().Method = r.Method
+		seg.GetHTTP().GetRequest().URL = r.URL.String()
+
+		r.Header.Set("x-amzn-trace-id", seg.DownstreamHeader().String())
+		seg.Unlock()
+
+		resp, err = rt.Base.RoundTrip(r)
+
+		if resp != nil {
+			seg.Lock()
+			seg.GetHTTP().GetResponse().Status = resp.StatusCode
+			seg.GetHTTP().GetResponse().ContentLength, _ = strconv.Atoi(resp.Header.Get("Content-Length"))
+
+			if resp.StatusCode >= 400 && resp.StatusCode < 500 {
+				seg.Error = true
+			}
+			if resp.StatusCode == 429 {
+				seg.Throttle = true
+			}
+			if resp.StatusCode >= 500 && resp.StatusCode < 600 {
+				seg.Fault = true
+			}
+			seg.Unlock()
+		}
+		if err != nil {
+			ct.subsegments.GotConn(nil, err)
+		}
+
+		return err
+	})
+	return resp, err
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/config.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/config.go
new file mode 100644
index 00000000..fefa5113
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/config.go
@@ -0,0 +1,231 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+import (
+	"fmt"
+	"net"
+	"os"
+	"sync"
+
+	"github.com/aws/aws-xray-sdk-go/strategy/ctxmissing"
+	"github.com/aws/aws-xray-sdk-go/strategy/exception"
+	"github.com/aws/aws-xray-sdk-go/strategy/sampling"
+	log "github.com/cihub/seelog"
+)
+
+var privateCfg = newPrivateConfig()
+
+func newPrivateConfig() *privateConfig {
+	ret := &privateConfig{
+		daemonAddr: &net.UDPAddr{
+			IP:   net.IPv4(127, 0, 0, 1),
+			Port: 2000,
+		},
+		logLevel:  log.InfoLvl,
+		logFormat: "%Date(2006-01-02T15:04:05Z07:00) [%Level] %Msg%n",
+	}
+
+	ss, err := sampling.NewLocalizedStrategy()
+	if err != nil {
+		panic(err)
+	}
+	ret.samplingStrategy = ss
+
+	efs, err := exception.NewDefaultFormattingStrategy()
+	if err != nil {
+		panic(err)
+	}
+	ret.exceptionFormattingStrategy = efs
+
+	sts, err := NewDefaultStreamingStrategy()
+	if err != nil {
+		panic(err)
+	}
+	ret.streamingStrategy = sts
+
+	cm := ctxmissing.NewDefaultRuntimeErrorStrategy()
+
+	ret.contextMissingStrategy = cm
+
+	return ret
+}
+
+type privateConfig struct {
+	sync.RWMutex
+
+	daemonAddr                  *net.UDPAddr
+	serviceVersion              string
+	samplingStrategy            sampling.Strategy
+	streamingStrategy           StreamingStrategy
+	exceptionFormattingStrategy exception.FormattingStrategy
+	contextMissingStrategy      ctxmissing.Strategy
+	logLevel                    log.LogLevel
+	logFormat                   string
+}
+
+// Config is a set of X-Ray configurations.
+type Config struct {
+	DaemonAddr                  string
+	ServiceVersion              string
+	SamplingStrategy            sampling.Strategy
+	StreamingStrategy           StreamingStrategy
+	ExceptionFormattingStrategy exception.FormattingStrategy
+	ContextMissingStrategy      ctxmissing.Strategy
+	LogLevel                    string
+	LogFormat                   string
+}
+
+// Configure overrides default configuration options with customer-defined values.
+func Configure(c Config) error {
+	privateCfg.Lock()
+	defer privateCfg.Unlock()
+
+	var errors exception.MultiError
+
+	var daemonAddress string
+	if addr := os.Getenv("AWS_XRAY_DAEMON_ADDRESS"); addr != "" {
+		daemonAddress = addr
+	} else if c.DaemonAddr != "" {
+		daemonAddress = c.DaemonAddr
+	}
+
+	if daemonAddress != "" {
+		addr, err := net.ResolveUDPAddr("udp", daemonAddress)
+		if err == nil {
+			privateCfg.daemonAddr = addr
+			go refreshEmitter()
+		} else {
+			errors = append(errors, err)
+		}
+	}
+
+	if c.SamplingStrategy != nil {
+		privateCfg.samplingStrategy = c.SamplingStrategy
+	}
+
+	if c.ExceptionFormattingStrategy != nil {
+		privateCfg.exceptionFormattingStrategy = c.ExceptionFormattingStrategy
+	}
+
+	if c.StreamingStrategy != nil {
+		privateCfg.streamingStrategy = c.StreamingStrategy
+	}
+
+	cms := os.Getenv("AWS_XRAY_CONTEXT_MISSING")
+	if cms != "" {
+		if cms == ctxmissing.RuntimeErrorStrategy {
+			cm := ctxmissing.NewDefaultRuntimeErrorStrategy()
+			privateCfg.contextMissingStrategy = cm
+		} else if cms == ctxmissing.LogErrorStrategy {
+			cm := ctxmissing.NewDefaultLogErrorStrategy()
+			privateCfg.contextMissingStrategy = cm
+		}
+	} else if c.ContextMissingStrategy != nil {
+		privateCfg.contextMissingStrategy = c.ContextMissingStrategy
+	}
+
+	if c.ServiceVersion != "" {
+		privateCfg.serviceVersion = c.ServiceVersion
+	}
+
+	privateCfg.logLevel, privateCfg.logFormat = loadLogConfig(c.LogLevel, c.LogFormat)
+
+	switch len(errors) {
+	case 0:
+		return nil
+	case 1:
+		return errors[0]
+	default:
+		return errors
+	}
+}
+
+func loadLogConfig(logLevel string, logFormat string) (log.LogLevel, string) {
+	var level log.LogLevel
+	var format string
+
+	switch logLevel {
+	case "trace":
+		level = log.TraceLvl
+	case "debug":
+		level = log.DebugLvl
+	case "info":
+		level = log.InfoLvl
+	case "warn":
+		level = log.WarnLvl
+	case "error":
+		level = log.ErrorLvl
+	default:
+		level = log.InfoLvl
+		logLevel = "info"
+	}
+
+	if logFormat != "" {
+		format = logFormat
+	} else {
+		format = "%Date(2006-01-02T15:04:05Z07:00) [%Level] %Msg%n"
+	}
+
+	writer, _ := log.NewConsoleWriter()
+	logger, err := log.LoggerFromWriterWithMinLevelAndFormat(writer, level, format)
+	if err != nil {
+		panic(fmt.Errorf("failed to create logs as StdOut: %v", err))
+	}
+	log.ReplaceLogger(logger)
+	return level, format
+}
+
+func (c *privateConfig) DaemonAddr() *net.UDPAddr {
+	c.RLock()
+	defer c.RUnlock()
+	return c.daemonAddr
+}
+
+func (c *privateConfig) SamplingStrategy() sampling.Strategy {
+	c.RLock()
+	defer c.RUnlock()
+	return c.samplingStrategy
+}
+
+func (c *privateConfig) StreamingStrategy() StreamingStrategy {
+	c.RLock()
+	defer c.RUnlock()
+	return c.streamingStrategy
+}
+
+func (c *privateConfig) ExceptionFormattingStrategy() exception.FormattingStrategy {
+	c.RLock()
+	defer c.RUnlock()
+	return c.exceptionFormattingStrategy
+}
+
+func (c *privateConfig) ContextMissingStrategy() ctxmissing.Strategy {
+	c.RLock()
+	defer c.RUnlock()
+	return c.contextMissingStrategy
+}
+
+func (c *privateConfig) ServiceVersion() string {
+	c.RLock()
+	defer c.RUnlock()
+	return c.serviceVersion
+}
+
+func (c *privateConfig) LogLevel() log.LogLevel {
+	c.RLock()
+	defer c.RUnlock()
+	return c.logLevel
+}
+
+func (c *privateConfig) LogFormat() string {
+	c.RLock()
+	defer c.RUnlock()
+	return c.logFormat
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/context.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/context.go
new file mode 100644
index 00000000..abd5a782
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/context.go
@@ -0,0 +1,95 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+import (
+	"context"
+	"errors"
+)
+
+// ContextKeytype defines integer to be type of ContextKey.
+type ContextKeytype int
+
+// ContextKey returns a pointer to a newly allocated zero value of ContextKeytype.
+var ContextKey = new(ContextKeytype)
+
+// ErrRetrieveSegment happens when a segment cannot be retrieved
+var ErrRetrieveSegment = errors.New("unable to retrieve segment")
+
+// GetSegment returns a pointer to the segment or subsegment provided
+// in ctx, or nil if no segment or subsegment is found.
+func GetSegment(ctx context.Context) *Segment {
+	if seg, ok := ctx.Value(ContextKey).(*Segment); ok {
+		return seg
+	}
+	return nil
+}
+
+// TraceID returns the canonical ID of the cross-service trace from the
+// given segment in ctx. The value can be used in X-Ray's UI to uniquely
+// identify the code paths executed. If no segment is provided in ctx,
+// an empty string is returned.
+func TraceID(ctx context.Context) string {
+	if seg, ok := ctx.Value(ContextKey).(*Segment); ok {
+		return seg.TraceID
+	}
+	return ""
+}
+
+// RequestWasTraced returns true if the context contains an X-Ray segment
+// that was created from an HTTP request that contained a trace header.
+// This is useful to ensure that a service is only called from X-Ray traced
+// services.
+func RequestWasTraced(ctx context.Context) bool {
+	for seg := GetSegment(ctx); seg != nil; seg = seg.parent {
+		if seg.RequestWasTraced {
+			return true
+		}
+	}
+	return false
+}
+
+// DetachContext returns a new context with the existing segment.
+// This is useful for creating background tasks which won't be cancelled
+// when a request completes.
+func DetachContext(ctx context.Context) context.Context {
+	return context.WithValue(context.Background(), ContextKey, GetSegment(ctx))
+}
+
+// AddAnnotation adds an annotation to the provided segment or subsegment in ctx.
+func AddAnnotation(ctx context.Context, key string, value interface{}) error {
+	if seg := GetSegment(ctx); seg != nil {
+		return seg.AddAnnotation(key, value)
+	}
+	return ErrRetrieveSegment
+}
+
+// AddMetadata adds a metadata to the provided segment or subsegment in ctx.
+func AddMetadata(ctx context.Context, key string, value interface{}) error {
+	if seg := GetSegment(ctx); seg != nil {
+		return seg.AddMetadata(key, value)
+	}
+	return ErrRetrieveSegment
+}
+
+// AddMetadataToNamespace adds a namespace to the provided segment's or subsegment's metadata in ctx.
+func AddMetadataToNamespace(ctx context.Context, namespace string, key string, value interface{}) error {
+	if seg := GetSegment(ctx); seg != nil {
+		return seg.AddMetadataToNamespace(namespace, key, value)
+	}
+	return ErrRetrieveSegment
+}
+
+// AddError adds an error to the provided segment or subsegment in ctx.
+func AddError(ctx context.Context, err error) error {
+	if seg := GetSegment(ctx); seg != nil {
+		return seg.AddError(err)
+	}
+	return ErrRetrieveSegment
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/default_streaming_strategy.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/default_streaming_strategy.go
new file mode 100644
index 00000000..0b8fb3fb
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/default_streaming_strategy.go
@@ -0,0 +1,85 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+import (
+	"encoding/json"
+	"errors"
+
+	log "github.com/cihub/seelog"
+)
+
+var defaultMaxSubsegmentCount = 20
+
+// DefaultStreamingStrategy provides a default value of 20
+// for the maximum number of subsegments that can be emitted
+// in a single UDP packet.
+type DefaultStreamingStrategy struct {
+	MaxSubsegmentCount int
+}
+
+// NewDefaultStreamingStrategy initializes and returns a
+// pointer to an instance of DefaultStreamingStrategy.
+func NewDefaultStreamingStrategy() (*DefaultStreamingStrategy, error) {
+	return &DefaultStreamingStrategy{MaxSubsegmentCount: defaultMaxSubsegmentCount}, nil
+}
+
+// NewDefaultStreamingStrategyWithMaxSubsegmentCount initializes
+// and returns a pointer to an instance of DefaultStreamingStrategy
+// with a custom maximum number of subsegments per UDP packet.
+func NewDefaultStreamingStrategyWithMaxSubsegmentCount(maxSubsegmentCount int) (*DefaultStreamingStrategy, error) {
+	if maxSubsegmentCount <= 0 {
+		return nil, errors.New("maxSubsegmentCount must be a non-negative integer")
+	}
+	return &DefaultStreamingStrategy{MaxSubsegmentCount: maxSubsegmentCount}, nil
+}
+
+// RequiresStreaming returns true when the number of subsegment
+// children for a given segment is larger than MaxSubsegmentCount.
+func (dSS *DefaultStreamingStrategy) RequiresStreaming(seg *Segment) bool {
+	if seg.ParentSegment.Sampled {
+		return seg.ParentSegment.totalSubSegments > dSS.MaxSubsegmentCount
+	}
+	return false
+}
+
+// StreamCompletedSubsegments separates subsegments from the provided
+// segment tree and sends them to daemon as streamed subsegment UDP packets.
+func (dSS *DefaultStreamingStrategy) StreamCompletedSubsegments(seg *Segment) [][]byte {
+	log.Trace("Beginning to stream subsegments.")
+	var outSegments [][]byte
+	for i := 0; i < len(seg.rawSubsegments); i++ {
+		child := seg.rawSubsegments[i]
+		seg.rawSubsegments[i] = seg.rawSubsegments[len(seg.rawSubsegments)-1]
+		seg.rawSubsegments[len(seg.rawSubsegments)-1] = nil
+		seg.rawSubsegments = seg.rawSubsegments[:len(seg.rawSubsegments)-1]
+
+		seg.Subsegments[i] = seg.Subsegments[len(seg.Subsegments)-1]
+		seg.Subsegments[len(seg.Subsegments)-1] = nil
+		seg.Subsegments = seg.Subsegments[:len(seg.Subsegments)-1]
+
+		seg.ParentSegment.totalSubSegments--
+
+		// Add extra information into child subsegment
+		child.Lock()
+		child.TraceID = seg.root().TraceID
+		child.ParentID = seg.ID
+		child.Type = "subsegment"
+		child.parent = nil
+		child.RequestWasTraced = seg.RequestWasTraced
+		cb, _ := json.Marshal(child)
+		outSegments = append(outSegments, cb)
+		log.Tracef("Streaming subsegment named '%s' from segment tree.", child.Name)
+		child.Unlock()
+
+		break
+	}
+	log.Trace("Finished streaming subsegments.")
+	return outSegments
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/emitter.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/emitter.go
new file mode 100644
index 00000000..cfb381b3
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/emitter.go
@@ -0,0 +1,89 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+import (
+	"bytes"
+	"encoding/json"
+	"net"
+	"sync"
+
+	log "github.com/cihub/seelog"
+)
+
+// Header is added before sending segments to daemon.
+var Header = []byte(`{"format": "json", "version": 1}` + "\n")
+
+type emitter struct {
+	sync.Mutex
+	conn *net.UDPConn
+}
+
+var e = &emitter{}
+
+func init() {
+	refreshEmitter()
+}
+
+func refreshEmitter() {
+	e.Lock()
+	e.conn, _ = net.DialUDP("udp", nil, privateCfg.DaemonAddr())
+	e.Unlock()
+}
+
+func emit(seg *Segment) {
+	if seg == nil || !seg.Sampled {
+		return
+	}
+
+	for _, p := range packSegments(seg, nil) {
+		if privateCfg.LogLevel() <= log.TraceLvl {
+			b := &bytes.Buffer{}
+			json.Indent(b, p, "", " ")
+			log.Trace(b.String())
+		}
+		e.Lock()
+		_, err := e.conn.Write(append(Header, p...))
+		if err != nil {
+			log.Error(err)
+		}
+		e.Unlock()
+	}
+}
+
+func packSegments(seg *Segment, outSegments [][]byte) [][]byte {
+	seg.Lock()
+	defer seg.Unlock()
+
+	trimSubsegment := func(s *Segment) []byte {
+		ss := privateCfg.StreamingStrategy()
+		for ss.RequiresStreaming(s) {
+			if len(s.rawSubsegments) == 0 {
+				break
+			}
+			cb := ss.StreamCompletedSubsegments(s)
+			outSegments = append(outSegments, cb...)
+		}
+		b, _ := json.Marshal(s)
+		return b
+	}
+
+	for _, s := range seg.rawSubsegments {
+		outSegments = packSegments(s, outSegments)
+		if b := trimSubsegment(s); b != nil {
+			seg.Subsegments = append(seg.Subsegments, b)
+		}
+	}
+	if seg.parent == nil {
+		if b := trimSubsegment(seg); b != nil {
+			outSegments = append(outSegments, b)
+		}
+	}
+	return outSegments
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/handler.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/handler.go
new file mode 100644
index 00000000..b53d885f
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/handler.go
@@ -0,0 +1,200 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+import (
+	"bytes"
+	"net/http"
+	"os"
+	"strconv"
+	"strings"
+
+	"github.com/aws/aws-xray-sdk-go/header"
+	"github.com/aws/aws-xray-sdk-go/pattern"
+	log "github.com/cihub/seelog"
+)
+
+// SegmentNamer is the interface for naming service node.
+type SegmentNamer interface {
+	Name(host string) string
+}
+
+// FixedSegmentNamer records the fixed name of service node.
+type FixedSegmentNamer struct {
+	FixedName string
+}
+
+// NewFixedSegmentNamer initializes a FixedSegmentNamer which
+// will provide a fixed segment name for every generated segment.
+// If the AWS_XRAY_TRACING_NAME environment variable is set,
+// its value will override the provided name argument.
+func NewFixedSegmentNamer(name string) *FixedSegmentNamer {
+	if fName := os.Getenv("AWS_XRAY_TRACING_NAME"); fName != "" {
+		name = fName
+	}
+	return &FixedSegmentNamer{
+		FixedName: name,
+	}
+}
+
+// Name returns the segment name for the given host header value.
+// In this case, FixedName is always returned.
+func (fSN *FixedSegmentNamer) Name(host string) string {
+	return fSN.FixedName
+}
+
+// DynamicSegmentNamer chooses names for segments generated
+// for incoming requests by parsing the HOST header of the
+// incoming request. If the host header matches a given
+// recognized pattern (using the included pattern package),
+// it is used as the segment name. Otherwise, the fallback
+// name is used.
+type DynamicSegmentNamer struct {
+	FallbackName    string
+	RecognizedHosts string
+}
+
+// NewDynamicSegmentNamer creates a new dynamic segment namer.
+func NewDynamicSegmentNamer(fallback string, recognized string) *DynamicSegmentNamer {
+	if dName := os.Getenv("AWS_XRAY_TRACING_NAME"); dName != "" {
+		fallback = dName
+	}
+	return &DynamicSegmentNamer{
+		FallbackName:    fallback,
+		RecognizedHosts: recognized,
+	}
+}
+
+// Name returns the segment name for the given host header value.
+func (dSN *DynamicSegmentNamer) Name(host string) string {
+	if pattern.WildcardMatchCaseInsensitive(dSN.RecognizedHosts, host) {
+		return host
+	}
+	return dSN.FallbackName
+}
+
+// Handler wraps the provided http handler with xray.Capture
+// using the request's context, parsing the incoming headers,
+// adding response headers if needed, and sets HTTP sepecific trace fields.
+// Handler names the generated segments using the provided SegmentNamer.
+func Handler(sn SegmentNamer, h http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		name := sn.Name(r.Host)
+
+		traceHeader := header.FromString(r.Header.Get("x-amzn-trace-id"))
+
+		ctx, seg := NewSegmentFromHeader(r.Context(), name, traceHeader)
+
+		r = r.WithContext(ctx)
+
+		seg.Lock()
+
+		seg.GetHTTP().GetRequest().Method = r.Method
+		seg.GetHTTP().GetRequest().URL = r.URL.String()
+		seg.GetHTTP().GetRequest().ClientIP, seg.GetHTTP().GetRequest().XForwardedFor = clientIP(r)
+		seg.GetHTTP().GetRequest().UserAgent = r.UserAgent()
+
+		trace := parseHeaders(r.Header)
+		if trace["Root"] != "" {
+			seg.TraceID = trace["Root"]
+			seg.RequestWasTraced = true
+		}
+		if trace["Parent"] != "" {
+			seg.ParentID = trace["Parent"]
+		}
+		// Don't use the segment's header here as we only want to
+		// send back the root and possibly sampled values.
+		var respHeader bytes.Buffer
+		respHeader.WriteString("Root=")
+		respHeader.WriteString(seg.TraceID)
+		switch trace["Sampled"] {
+		case "0":
+			seg.Sampled = false
+			log.Trace("Incoming header decided: Sampled=false")
+		case "1":
+			seg.Sampled = true
+			log.Trace("Incoming header decided: Sampled=true")
+		default:
+			seg.Sampled = privateCfg.SamplingStrategy().ShouldTrace(r.Host, r.URL.String(), r.Method)
+			log.Tracef("SamplingStrategy decided: %t", seg.Sampled)
+		}
+		if trace["Sampled"] == "?" {
+			respHeader.WriteString(";Sampled=")
+			respHeader.WriteString(strconv.Itoa(btoi(seg.Sampled)))
+		}
+		w.Header().Set("x-amzn-trace-id", respHeader.String())
+		seg.Unlock()
+
+		resp := &responseCapturer{w, 200, 0}
+		h.ServeHTTP(resp, r)
+
+		seg.Lock()
+		seg.GetHTTP().GetResponse().Status = resp.status
+		seg.GetHTTP().GetResponse().ContentLength, _ = strconv.Atoi(resp.Header().Get("Content-Length"))
+
+		if resp.status >= 400 && resp.status < 500 {
+			seg.Error = true
+		}
+		if resp.status == 429 {
+			seg.Throttle = true
+		}
+		if resp.status >= 500 && resp.status < 600 {
+			seg.Fault = true
+		}
+		seg.Unlock()
+		seg.Close(nil)
+	})
+}
+
+func clientIP(r *http.Request) (string, bool) {
+	forwardedFor := r.Header.Get("X-Forwarded-For")
+	if forwardedFor != "" {
+		return strings.TrimSpace(strings.Split(forwardedFor, ",")[0]), true
+	}
+
+	return r.RemoteAddr, false
+}
+
+type responseCapturer struct {
+	http.ResponseWriter
+	status int
+	length int
+}
+
+func (w *responseCapturer) WriteHeader(status int) {
+	w.status = status
+	w.ResponseWriter.WriteHeader(status)
+}
+
+func (w *responseCapturer) Write(data []byte) (int, error) {
+	w.length += len(data)
+	return w.ResponseWriter.Write(data)
+}
+
+func btoi(b bool) int {
+	if b {
+		return 1
+	}
+	return 0
+}
+
+func parseHeaders(h http.Header) map[string]string {
+	m := map[string]string{}
+	s := h.Get("x-amzn-trace-id")
+	for _, c := range strings.Split(s, ";") {
+		p := strings.SplitN(c, "=", 2)
+		k := strings.TrimSpace(p[0])
+		v := ""
+		if len(p) > 1 {
+			v = strings.TrimSpace(p[1])
+		}
+		m[k] = v
+	}
+	return m
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/httptrace.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/httptrace.go
new file mode 100644
index 00000000..22f0ad17
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/httptrace.go
@@ -0,0 +1,209 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"net/http/httptrace"
+)
+
+type HTTPSubsegments struct {
+	opCtx       context.Context
+	connCtx     context.Context
+	dnsCtx      context.Context
+	connectCtx  context.Context
+	tlsCtx      context.Context
+	reqCtx      context.Context
+	responseCtx context.Context
+}
+
+// GetConn begins a connect subsegment if the HTTP operation
+// subsegment is still in progress.
+func (xt *HTTPSubsegments) GetConn(hostPort string) {
+	if GetSegment(xt.opCtx).InProgress {
+		xt.connCtx, _ = BeginSubsegment(xt.opCtx, "connect")
+	}
+}
+
+// DNSStart begins a dns subsegment if the HTTP operation
+// subsegment is still in progress.
+func (xt *HTTPSubsegments) DNSStart(info httptrace.DNSStartInfo) {
+	if GetSegment(xt.opCtx).InProgress {
+		xt.dnsCtx, _ = BeginSubsegment(xt.connCtx, "dns")
+	}
+}
+
+// DNSDone closes the dns subsegment if the HTTP operation
+// subsegment is still in progress, passing the error value
+// (if any). Information about the address values looked up,
+// and whether or not the call was coalesced is added as
+// metadata to the dns subsegment.
+func (xt *HTTPSubsegments) DNSDone(info httptrace.DNSDoneInfo) {
+	if xt.dnsCtx != nil && GetSegment(xt.opCtx).InProgress {
+		metadata := make(map[string]interface{})
+		metadata["addresses"] = info.Addrs
+		metadata["coalesced"] = info.Coalesced
+
+		AddMetadataToNamespace(xt.dnsCtx, "http", "dns", metadata)
+		GetSegment(xt.dnsCtx).Close(info.Err)
+	}
+}
+
+// ConnectStart begins a dial subsegment if the HTTP operation
+// subsegment is still in progress.
+func (xt *HTTPSubsegments) ConnectStart(network, addr string) {
+	if GetSegment(xt.opCtx).InProgress {
+		xt.connectCtx, _ = BeginSubsegment(xt.connCtx, "dial")
+	}
+}
+
+// ConnectDone closes the dial subsegment if the HTTP operation
+// subsegment is still in progress, passing the error value
+// (if any). Information about the network over which the dial
+// was made is added as metadata to the subsegment.
+func (xt *HTTPSubsegments) ConnectDone(network, addr string, err error) {
+	if xt.connectCtx != nil && GetSegment(xt.opCtx).InProgress {
+		metadata := make(map[string]interface{})
+		metadata["network"] = network
+
+		AddMetadataToNamespace(xt.connectCtx, "http", "connect", metadata)
+		GetSegment(xt.connectCtx).Close(err)
+	}
+}
+
+// TLSHandshakeStart begins a tls subsegment if the HTTP operation
+// subsegment is still in progress.
+func (xt *HTTPSubsegments) TLSHandshakeStart() {
+	if GetSegment(xt.opCtx).InProgress {
+		xt.tlsCtx, _ = BeginSubsegment(xt.connCtx, "tls")
+	}
+}
+
+// TLSHandshakeDone closes the tls subsegment if the HTTP
+// operation subsegment is still in progress, passing the
+// error value(if any). Information about the tls connection
+// is added as metadata to the subsegment.
+func (xt *HTTPSubsegments) TLSHandshakeDone(connState tls.ConnectionState, err error) {
+	if xt.tlsCtx != nil && GetSegment(xt.opCtx).InProgress {
+		metadata := make(map[string]interface{})
+		metadata["did_resume"] = connState.DidResume
+		metadata["negotiated_protocol"] = connState.NegotiatedProtocol
+		metadata["negotiated_protocol_is_mutual"] = connState.NegotiatedProtocolIsMutual
+		metadata["cipher_suite"] = connState.CipherSuite
+
+		AddMetadataToNamespace(xt.tlsCtx, "http", "tls", metadata)
+		GetSegment(xt.tlsCtx).Close(err)
+	}
+}
+
+// GotConn closes the connect subsegment if the HTTP operation
+// subsegment is still in progress, passing the error value
+// (if any). Information about the connection is added as
+// metadata to the subsegment. If the connection is marked as reused,
+// the connect subsegment is deleted.
+func (xt *HTTPSubsegments) GotConn(info *httptrace.GotConnInfo, err error) {
+	if xt.connCtx != nil && GetSegment(xt.opCtx).InProgress { // GetConn may not have been called (client_test.TestBadRoundTrip)
+		if info != nil {
+			if info.Reused {
+				GetSegment(xt.opCtx).RemoveSubsegment(GetSegment(xt.connCtx))
+			} else {
+				metadata := make(map[string]interface{})
+				metadata["reused"] = info.Reused
+				metadata["was_idle"] = info.WasIdle
+				if info.WasIdle {
+					metadata["idle_time"] = info.IdleTime
+				}
+
+				AddMetadataToNamespace(xt.connCtx, "http", "connection", metadata)
+				GetSegment(xt.connCtx).Close(err)
+			}
+		}
+
+		if err == nil {
+			xt.reqCtx, _ = BeginSubsegment(xt.opCtx, "request")
+		}
+
+	}
+}
+
+// WroteRequest closes the request subsegment if the HTTP operation
+// subsegment is still in progress, passing the error value
+// (if any). The response subsegment is then begun.
+func (xt *HTTPSubsegments) WroteRequest(info httptrace.WroteRequestInfo) {
+	if xt.reqCtx != nil && GetSegment(xt.opCtx).InProgress {
+		GetSegment(xt.reqCtx).Close(info.Err)
+		xt.responseCtx, _ = BeginSubsegment(xt.opCtx, "response")
+	}
+}
+
+// GotFirstResponseByte closes the response subsegment if the HTTP
+// operation subsegment is still in progress.
+func (xt *HTTPSubsegments) GotFirstResponseByte() {
+	if xt.responseCtx != nil && GetSegment(xt.opCtx).InProgress {
+		GetSegment(xt.responseCtx).Close(nil)
+	}
+}
+
+type ClientTrace struct {
+	subsegments *HTTPSubsegments
+	httpTrace   *httptrace.ClientTrace
+}
+
+// NewClientTrace returns an instance of xray.ClientTrace, a wrapper
+// around httptrace.ClientTrace. The ClientTrace implementation will
+// generate subsegments for connection time, DNS lookup time, TLS
+// handshake time, and provides additional information about the HTTP round trip
+func NewClientTrace(opCtx context.Context) (ct *ClientTrace, err error) {
+	if opCtx == nil {
+		return nil, errors.New("opCtx must be non-nil")
+	}
+
+	segs := &HTTPSubsegments{
+		opCtx: opCtx,
+	}
+
+	return &ClientTrace{
+		subsegments: segs,
+		httpTrace: &httptrace.ClientTrace{
+			GetConn: func(hostPort string) {
+				segs.GetConn(hostPort)
+			},
+			DNSStart: func(info httptrace.DNSStartInfo) {
+				segs.DNSStart(info)
+			},
+			DNSDone: func(info httptrace.DNSDoneInfo) {
+				segs.DNSDone(info)
+			},
+			ConnectStart: func(network, addr string) {
+				segs.ConnectStart(network, addr)
+			},
+			ConnectDone: func(network, addr string, err error) {
+				segs.ConnectDone(network, addr, err)
+			},
+			TLSHandshakeStart: func() {
+				segs.TLSHandshakeStart()
+			},
+			TLSHandshakeDone: func(connState tls.ConnectionState, err error) {
+				segs.TLSHandshakeDone(connState, err)
+			},
+			GotConn: func(info httptrace.GotConnInfo) {
+				segs.GotConn(&info, nil)
+			},
+			WroteRequest: func(info httptrace.WroteRequestInfo) {
+				segs.WroteRequest(info)
+			},
+			GotFirstResponseByte: func() {
+				segs.GotFirstResponseByte()
+			},
+		},
+	}, nil
+
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/segment.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/segment.go
new file mode 100644
index 00000000..b3169ea0
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/segment.go
@@ -0,0 +1,275 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+import (
+	"context"
+	"crypto/rand"
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/aws/aws-xray-sdk-go/header"
+	"github.com/aws/aws-xray-sdk-go/internal/plugins"
+	log "github.com/cihub/seelog"
+)
+
+// NewTraceID generates a string format of random trace ID.
+func NewTraceID() string {
+	var r [12]byte
+	_, err := rand.Read(r[:])
+	if err != nil {
+		panic(err)
+	}
+	return fmt.Sprintf("1-%08x-%02x", time.Now().Unix(), r)
+}
+
+// NewSegmentID generates a string format of segment ID.
+func NewSegmentID() string {
+	var r [8]byte
+	_, err := rand.Read(r[:])
+	if err != nil {
+		panic(err)
+	}
+	return fmt.Sprintf("%02x", r)
+}
+
+// BeginSegment creates a Segment for a given name and context.
+func BeginSegment(ctx context.Context, name string) (context.Context, *Segment) {
+	if len(name) > 200 {
+		name = name[:200]
+	}
+	seg := &Segment{parent: nil}
+	log.Tracef("Beginning segment named %s", name)
+	seg.ParentSegment = seg
+
+	seg.Lock()
+	defer seg.Unlock()
+
+	seg.TraceID = NewTraceID()
+	seg.Sampled = true
+	seg.addPlugin(plugins.InstancePluginMetadata)
+	if svcVersion := privateCfg.ServiceVersion(); svcVersion != "" {
+		seg.GetService().Version = svcVersion
+	}
+	seg.ID = NewSegmentID()
+	seg.Name = name
+	seg.StartTime = float64(time.Now().UnixNano()) / float64(time.Second)
+	seg.InProgress = true
+
+	go func() {
+		select {
+		case <-ctx.Done():
+			seg.Lock()
+			seg.ContextDone = true
+			seg.Unlock()
+			if !seg.InProgress && !seg.Emitted {
+				seg.flush(false)
+			}
+		}
+	}()
+
+	return context.WithValue(ctx, ContextKey, seg), seg
+}
+
+// BeginSubsegment creates a subsegment for a given name and context.
+func BeginSubsegment(ctx context.Context, name string) (context.Context, *Segment) {
+	if len(name) > 200 {
+		name = name[:200]
+	}
+	parent := GetSegment(ctx)
+	if parent == nil {
+		privateCfg.ContextMissingStrategy().ContextMissing(fmt.Sprintf("failed to begin subsegment named '%v': segment cannot be found.", name))
+		return nil, nil
+	}
+
+	seg := &Segment{parent: parent}
+	log.Tracef("Beginning subsegment named %s", name)
+	seg.ParentSegment = parent.ParentSegment
+	seg.ParentSegment.totalSubSegments++
+	seg.Lock()
+	defer seg.Unlock()
+
+	parent.Lock()
+	parent.rawSubsegments = append(parent.rawSubsegments, seg)
+	parent.openSegments++
+	parent.Unlock()
+
+	seg.ID = NewSegmentID()
+	seg.Name = name
+	seg.StartTime = float64(time.Now().UnixNano()) / float64(time.Second)
+	seg.InProgress = true
+
+	return context.WithValue(ctx, ContextKey, seg), seg
+}
+
+// NewSegmentFromHeader creates a segment for downstream call and add information to the segment that gets from HTTP header.
+func NewSegmentFromHeader(ctx context.Context, name string, h *header.Header) (context.Context, *Segment) {
+	con, seg := BeginSegment(ctx, name)
+
+	if h.TraceID != "" {
+		seg.TraceID = h.TraceID
+	}
+	if h.ParentID != "" {
+		seg.ParentID = h.ParentID
+	}
+	seg.Sampled = h.SamplingDecision == header.Sampled
+	seg.IncomingHeader = h
+
+	return con, seg
+}
+
+// Close a segment.
+func (seg *Segment) Close(err error) {
+
+	seg.Lock()
+	if seg.parent != nil {
+		log.Tracef("Closing subsegment named %s", seg.Name)
+	} else {
+		log.Tracef("Closing segment named %s", seg.Name)
+	}
+	seg.EndTime = float64(time.Now().UnixNano()) / float64(time.Second)
+	seg.InProgress = false
+	seg.Unlock()
+
+	if err != nil {
+		seg.AddError(err)
+	}
+
+	seg.flush(false)
+}
+
+// RemoveSubsegment removes a subsegment child from a segment or subsegment.
+func (seg *Segment) RemoveSubsegment(remove *Segment) bool {
+	seg.Lock()
+	defer seg.Unlock()
+
+	for i, v := range seg.rawSubsegments {
+		if v == remove {
+			seg.rawSubsegments[i] = seg.rawSubsegments[len(seg.rawSubsegments)-1]
+			seg.rawSubsegments[len(seg.rawSubsegments)-1] = nil
+			seg.rawSubsegments = seg.rawSubsegments[:len(seg.rawSubsegments)-1]
+
+			seg.totalSubSegments--
+			seg.openSegments--
+			return true
+		}
+	}
+	return false
+}
+
+func (seg *Segment) flush(decrement bool) {
+	seg.Lock()
+	if decrement {
+		seg.openSegments--
+	}
+	shouldFlush := (seg.openSegments == 0 && seg.EndTime > 0) || seg.ContextDone
+	seg.Unlock()
+
+	if shouldFlush {
+		if seg.parent == nil {
+			seg.Lock()
+			seg.Emitted = true
+			seg.Unlock()
+			emit(seg)
+		} else {
+			seg.parent.flush(true)
+		}
+	}
+}
+
+func (seg *Segment) root() *Segment {
+	if seg.parent == nil {
+		return seg
+	}
+	return seg.parent.root()
+}
+
+func (seg *Segment) addPlugin(metadata *plugins.PluginMetadata) {
+	//Only called within a seg locked code block
+	if metadata == nil {
+		return
+	}
+
+	if metadata.IdentityDocument != nil {
+		seg.GetAWS()["account_id"] = metadata.IdentityDocument.AccountID
+		seg.GetAWS()["instace_id"] = metadata.IdentityDocument.InstanceID
+		seg.GetAWS()["availability_zone"] = metadata.IdentityDocument.AvailabilityZone
+	}
+
+	if metadata.ECSContainerName != "" {
+		seg.GetAWS()["container"] = metadata.ECSContainerName
+	}
+
+	if metadata.BeanstalkMetadata != nil {
+		seg.GetAWS()["environment"] = metadata.BeanstalkMetadata.Environment
+		seg.GetAWS()["version_label"] = metadata.BeanstalkMetadata.VersionLabel
+		seg.GetAWS()["deployment_id"] = metadata.BeanstalkMetadata.DeploymentID
+	}
+}
+
+// AddAnnotation allows adding an annotation to the segment.
+func (seg *Segment) AddAnnotation(key string, value interface{}) error {
+	switch value.(type) {
+	case bool, int, uint, float32, float64, string:
+	default:
+		return fmt.Errorf("failed to add annotation key: %q value: %q to subsegment %q. value must be of type string, number or boolean", key, value, seg.Name)
+	}
+
+	seg.Lock()
+	defer seg.Unlock()
+
+	if seg.Annotations == nil {
+		seg.Annotations = map[string]interface{}{}
+	}
+	seg.Annotations[key] = value
+	return nil
+}
+
+// AddMetadata allows adding metadata to the segment.
+func (seg *Segment) AddMetadata(key string, value interface{}) error {
+	seg.Lock()
+	defer seg.Unlock()
+
+	if seg.Metadata == nil {
+		seg.Metadata = map[string]map[string]interface{}{}
+	}
+	if seg.Metadata["default"] == nil {
+		seg.Metadata["default"] = map[string]interface{}{}
+	}
+	seg.Metadata["default"][key] = value
+	return nil
+}
+
+// AddMetadataToNamespace allows adding a namespace into metadata for the segment.
+func (seg *Segment) AddMetadataToNamespace(namespace string, key string, value interface{}) error {
+	seg.Lock()
+	defer seg.Unlock()
+
+	if seg.Metadata == nil {
+		seg.Metadata = map[string]map[string]interface{}{}
+	}
+	if seg.Metadata[namespace] == nil {
+		seg.Metadata[namespace] = map[string]interface{}{}
+	}
+	seg.Metadata[namespace][key] = value
+	return nil
+}
+
+// AddError allows adding an error to the segment.
+func (seg *Segment) AddError(err error) error {
+	seg.Lock()
+	defer seg.Unlock()
+
+	seg.Fault = true
+	seg.GetCause().WorkingDirectory, _ = os.Getwd()
+	seg.GetCause().Exceptions = append(seg.GetCause().Exceptions, privateCfg.ExceptionFormattingStrategy().ExceptionFromError(err))
+
+	return nil
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/segment_model.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/segment_model.go
new file mode 100644
index 00000000..80e85cb0
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/segment_model.go
@@ -0,0 +1,191 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+import (
+	"encoding/json"
+	"sync"
+
+	"github.com/aws/aws-xray-sdk-go/header"
+	"github.com/aws/aws-xray-sdk-go/strategy/exception"
+)
+
+// Segment provides the resource's name, details about the request, and details about the work done.
+type Segment struct {
+	sync.Mutex
+	parent           *Segment
+	openSegments     int
+	totalSubSegments int
+	Sampled          bool           `json:"-"`
+	RequestWasTraced bool           `json:"-"` // Used by xray.RequestWasTraced
+	ContextDone      bool           `json:"-"`
+	Emitted          bool           `json:"-"`
+	IncomingHeader   *header.Header `json:"-"`
+	ParentSegment    *Segment       `json:"-"` // The root of the Segment tree, the parent Segment (not Subsegment).
+
+	// Required
+	TraceID   string  `json:"trace_id,omitempty"`
+	ID        string  `json:"id"`
+	Name      string  `json:"name"`
+	StartTime float64 `json:"start_time"`
+	EndTime   float64 `json:"end_time,omitempty"`
+
+	// Optional
+	InProgress  bool       `json:"in_progress,omitempty"`
+	ParentID    string     `json:"parent_id,omitempty"`
+	Fault       bool       `json:"fault,omitempty"`
+	Error       bool       `json:"error,omitempty"`
+	Throttle    bool       `json:"throttle,omitempty"`
+	Cause       *CauseData `json:"cause,omitempty"`
+	ResourceARN string     `json:"resource_arn,omitempty"`
+	Origin      string     `json:"origin,omitempty"`
+
+	Type         string   `json:"type,omitempty"`
+	Namespace    string   `json:"namespace,omitempty"`
+	User         string   `json:"user,omitempty"`
+	PrecursorIDs []string `json:"precursor_ids,omitempty"`
+
+	HTTP *HTTPData              `json:"http,omitempty"`
+	AWS  map[string]interface{} `json:"aws,omitempty"`
+
+	Service *ServiceData `json:"service,omitempty"`
+
+	// SQL
+	SQL *SQLData `json:"sql,omitempty"`
+
+	// Metadata
+	Annotations map[string]interface{}            `json:"annotations,omitempty"`
+	Metadata    map[string]map[string]interface{} `json:"metadata,omitempty"`
+
+	// Children
+	Subsegments    []json.RawMessage `json:"subsegments,omitempty"`
+	rawSubsegments []*Segment
+}
+
+// CauseData provides the shape for unmarshaling data that records exception.
+type CauseData struct {
+	WorkingDirectory string                `json:"working_directory,omitempty"`
+	Paths            []string              `json:"paths,omitempty"`
+	Exceptions       []exception.Exception `json:"exceptions,omitempty"`
+}
+
+// HTTPData provides the shape for unmarshaling request and response data.
+type HTTPData struct {
+	Request  *RequestData  `json:"request,omitempty"`
+	Response *ResponseData `json:"response,omitempty"`
+}
+
+// RequestData provides the shape for unmarshaling request data.
+type RequestData struct {
+	Method        string `json:"method,omitempty"`
+	URL           string `json:"url,omitempty"` // http(s)://host/path
+	ClientIP      string `json:"client_ip,omitempty"`
+	UserAgent     string `json:"user_agent,omitempty"`
+	XForwardedFor bool   `json:"x_forwarded_for,omitempty"`
+	Traced        bool   `json:"traced,omitempty"`
+}
+
+// ResponseData provides the shape for unmarshaling response data.
+type ResponseData struct {
+	Status        int `json:"status,omitempty"`
+	ContentLength int `json:"content_length,omitempty"`
+}
+
+// ServiceData provides the shape for unmarshaling service version.
+type ServiceData struct {
+	Version string `json:"version,omitempty"`
+}
+
+// SQLData provides the shape for unmarshaling sql data.
+type SQLData struct {
+	ConnectionString string `json:"connection_string,omitempty"`
+	URL              string `json:"url,omitempty"` // host:port/database
+	DatabaseType     string `json:"database_type,omitempty"`
+	DatabaseVersion  string `json:"database_version,omitempty"`
+	DriverVersion    string `json:"driver_version,omitempty"`
+	User             string `json:"user,omitempty"`
+	Preparation      string `json:"preparation,omitempty"` // "statement" / "call"
+	SanitizedQuery   string `json:"sanitized_query,omitempty"`
+}
+
+// DownstreamHeader returns a header for passing to downstream calls.
+func (s *Segment) DownstreamHeader() *header.Header {
+	r := s.ParentSegment.IncomingHeader
+	if r == nil {
+		r = &header.Header{
+			TraceID: s.ParentSegment.TraceID,
+		}
+	}
+	if r.TraceID == "" {
+		r.TraceID = s.ParentSegment.TraceID
+	}
+	if s.ParentSegment.Sampled {
+		r.SamplingDecision = header.Sampled
+	} else {
+		r.SamplingDecision = header.NotSampled
+	}
+	r.ParentID = s.ID
+	return r
+}
+
+// GetCause returns value of Cause.
+func (s *Segment) GetCause() *CauseData {
+	if s.Cause == nil {
+		s.Cause = &CauseData{}
+	}
+	return s.Cause
+}
+
+// GetHTTP returns value of HTTP.
+func (s *Segment) GetHTTP() *HTTPData {
+	if s.HTTP == nil {
+		s.HTTP = &HTTPData{}
+	}
+	return s.HTTP
+}
+
+// GetAWS returns value of AWS.
+func (s *Segment) GetAWS() map[string]interface{} {
+	if s.AWS == nil {
+		s.AWS = make(map[string]interface{})
+	}
+	return s.AWS
+}
+
+// GetService returns value of Service.
+func (s *Segment) GetService() *ServiceData {
+	if s.Service == nil {
+		s.Service = &ServiceData{}
+	}
+	return s.Service
+}
+
+// GetSQL returns value of SQL.
+func (s *Segment) GetSQL() *SQLData {
+	if s.SQL == nil {
+		s.SQL = &SQLData{}
+	}
+	return s.SQL
+}
+
+// GetRequest returns value of RequestData.
+func (d *HTTPData) GetRequest() *RequestData {
+	if d.Request == nil {
+		d.Request = &RequestData{}
+	}
+	return d.Request
+}
+
+// GetResponse returns value of ResponseData.
+func (d *HTTPData) GetResponse() *ResponseData {
+	if d.Response == nil {
+		d.Response = &ResponseData{}
+	}
+	return d.Response
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/sql.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/sql.go
new file mode 100644
index 00000000..d463672f
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/sql.go
@@ -0,0 +1,274 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+import (
+	"bytes"
+	"context"
+	"database/sql"
+	"database/sql/driver"
+	"fmt"
+	"net/url"
+	"reflect"
+	"strings"
+	"time"
+)
+
+// SQL opens a normalized and traced wrapper around an *sql.DB connection.
+// It uses `sql.Open` internally and shares the same function signature.
+// To ensure passwords are filtered, it is HIGHLY RECOMMENDED that your DSN
+// follows the format: `<schema>://<user>:<password>@<host>:<port>/<database>`
+func SQL(driver, dsn string) (*DB, error) {
+	rawDB, err := sql.Open(driver, dsn)
+	if err != nil {
+		return nil, err
+	}
+
+	db := &DB{db: rawDB}
+
+	// Detect if DSN is a URL or not, set appropriate attribute
+	urlDsn := dsn
+	if !strings.Contains(dsn, "//") {
+		urlDsn = "//" + urlDsn
+	}
+	// Here we're trying to detect things like `host:port/database` as a URL, which is pretty hard
+	// So we just assume that if it's got a scheme, a user, or a query that it's probably a URL
+	if u, err := url.Parse(urlDsn); err == nil && (u.Scheme != "" || u.User != nil || u.RawQuery != "" || strings.Contains(u.Path, "@")) {
+		// Check that this isn't in the form of user/pass@host:port/db, as that will shove the host into the path
+		if strings.Contains(u.Path, "@") {
+			u, _ = url.Parse(fmt.Sprintf("%s//%s%%2F%s", u.Scheme, u.Host, u.Path[1:]))
+		}
+
+		// Strip password from user:password pair in address
+		if u.User != nil {
+			uname := u.User.Username()
+
+			// Some drivers use "user/pass@host:port" instead of "user:pass@host:port"
+			// So we must manually attempt to chop off a potential password.
+			// But we can skip this if we already found the password.
+			if _, ok := u.User.Password(); !ok {
+				uname = strings.Split(uname, "/")[0]
+			}
+
+			u.User = url.User(uname)
+		}
+
+		// Strip password from query parameters
+		q := u.Query()
+		q.Del("password")
+		u.RawQuery = q.Encode()
+
+		db.url = u.String()
+		if !strings.Contains(dsn, "//") {
+			db.url = db.url[2:]
+		}
+	} else {
+		// We don't *think* it's a URL, so now we have to try our best to strip passwords from
+		// some unknown DSL. We attempt to detect whether it's space-delimited or semicolon-delimited
+		// then remove any keys with the name "password" or "pwd". This won't catch everything, but
+		// from surveying the current (Jan 2017) landscape of drivers it should catch most.
+		db.connectionString = stripPasswords(dsn)
+	}
+
+	// Detect database type and use that to populate attributes
+	var detectors []func(*DB) error
+	switch driver {
+	case "postgres":
+		detectors = append(detectors, postgresDetector)
+	case "mysql":
+		detectors = append(detectors, mysqlDetector)
+	default:
+		detectors = append(detectors, postgresDetector, mysqlDetector, mssqlDetector, oracleDetector)
+	}
+	for _, detector := range detectors {
+		if detector(db) == nil {
+			break
+		}
+		db.databaseType = "Unknown"
+		db.databaseVersion = "Unknown"
+		db.user = "Unknown"
+		db.dbname = "Unknown"
+	}
+
+	// There's no standard to get SQL driver version information
+	// So we invent an interface by which drivers can provide us this data
+	type versionedDriver interface {
+		Version() string
+	}
+
+	d := db.db.Driver()
+	if vd, ok := d.(versionedDriver); ok {
+		db.driverVersion = vd.Version()
+	} else {
+		t := reflect.TypeOf(d)
+		for t.Kind() == reflect.Ptr {
+			t = t.Elem()
+		}
+		db.driverVersion = t.PkgPath()
+	}
+
+	return db, nil
+}
+
+// DB copies the interface of sql.DB but adds X-Ray tracing.
+// It must be created with xray.SQL.
+type DB struct {
+	db *sql.DB
+
+	connectionString string
+	url              string
+	databaseType     string
+	databaseVersion  string
+	driverVersion    string
+	user             string
+	dbname           string
+}
+
+// Close closes a database and returns error if any.
+func (db *DB) Close() error { return db.db.Close() }
+
+// Driver returns database's underlying driver.
+func (db *DB) Driver() driver.Driver { return db.db.Driver() }
+
+// Stats returns database statistics.
+func (db *DB) Stats() sql.DBStats { return db.db.Stats() }
+
+// SetConnMaxLifetime sets the maximum amount of time a connection may be reused.
+func (db *DB) SetConnMaxLifetime(d time.Duration) { db.db.SetConnMaxLifetime(d) }
+
+// SetMaxIdleConns sets the maximum number of connections in the idle connection pool.
+func (db *DB) SetMaxIdleConns(n int) { db.db.SetMaxIdleConns(n) }
+
+// SetMaxOpenConns sets the maximum number of open connections to the database.
+func (db *DB) SetMaxOpenConns(n int) { db.db.SetMaxOpenConns(n) }
+
+func (db *DB) populate(ctx context.Context, query string) {
+	seg := GetSegment(ctx)
+
+	seg.Lock()
+	seg.Namespace = "remote"
+	seg.GetSQL().ConnectionString = db.connectionString
+	seg.GetSQL().URL = db.url
+	seg.GetSQL().DatabaseType = db.databaseType
+	seg.GetSQL().DatabaseVersion = db.databaseVersion
+	seg.GetSQL().DriverVersion = db.driverVersion
+	seg.GetSQL().User = db.user
+	seg.GetSQL().SanitizedQuery = query
+	seg.Unlock()
+}
+
+// Tx copies the interface of sql.Tx but adds X-Ray tracing.
+// It must be created with xray.DB.Begin.
+type Tx struct {
+	db *DB
+	tx *sql.Tx
+}
+
+// Commit commits the transaction.
+func (tx *Tx) Commit() error { return tx.tx.Commit() }
+
+// Rollback aborts the transaction.
+func (tx *Tx) Rollback() error { return tx.tx.Rollback() }
+
+// Stmt copies the interface of sql.Stmt but adds X-Ray tracing.
+// It must be created with xray.DB.Prepare or xray.Tx.Stmt.
+type Stmt struct {
+	db    *DB
+	stmt  *sql.Stmt
+	query string
+}
+
+// Close closes the statement.
+func (stmt *Stmt) Close() error { return stmt.stmt.Close() }
+
+func (stmt *Stmt) populate(ctx context.Context, query string) {
+	stmt.db.populate(ctx, query)
+
+	seg := GetSegment(ctx)
+	seg.Lock()
+	seg.GetSQL().Preparation = "statement"
+	seg.Unlock()
+}
+
+func postgresDetector(db *DB) error {
+	db.databaseType = "Postgres"
+	row := db.db.QueryRow("SELECT version(), current_user, current_database()")
+	return row.Scan(&db.databaseVersion, &db.user, &db.dbname)
+}
+
+func mysqlDetector(db *DB) error {
+	db.databaseType = "MySQL"
+	row := db.db.QueryRow("SELECT version(), current_user(), database()")
+	return row.Scan(&db.databaseVersion, &db.user, &db.dbname)
+}
+
+func mssqlDetector(db *DB) error {
+	db.databaseType = "MS SQL"
+	row := db.db.QueryRow("SELECT @@version, current_user, db_name()")
+	return row.Scan(&db.databaseVersion, &db.user, &db.dbname)
+}
+
+func oracleDetector(db *DB) error {
+	db.databaseType = "Oracle"
+	row := db.db.QueryRow("SELECT version FROM v$instance UNION SELECT user, ora_database_name FROM dual")
+	return row.Scan(&db.databaseVersion, &db.user, &db.dbname)
+}
+
+func stripPasswords(dsn string) string {
+	var (
+		tok        bytes.Buffer
+		res        bytes.Buffer
+		isPassword bool
+		inBraces   bool
+		delimiter  byte = ' '
+	)
+	flush := func() {
+		if inBraces {
+			return
+		}
+		if !isPassword {
+			res.Write(tok.Bytes())
+		}
+		tok.Reset()
+		isPassword = false
+	}
+	if strings.Count(dsn, ";") > strings.Count(dsn, " ") {
+		delimiter = ';'
+	}
+
+	buf := strings.NewReader(dsn)
+	for c, err := buf.ReadByte(); err == nil; c, err = buf.ReadByte() {
+		tok.WriteByte(c)
+		switch c {
+		case ':', delimiter:
+			flush()
+		case '=':
+			tokStr := strings.ToLower(tok.String())
+			isPassword = `password=` == tokStr || `pwd=` == tokStr
+			if b, err := buf.ReadByte(); err == nil && b == '{' {
+				inBraces = true
+			}
+			buf.UnreadByte()
+		case '}':
+			b, err := buf.ReadByte()
+			if err != nil {
+				break
+			}
+			if b == '}' {
+				tok.WriteByte(b)
+			} else {
+				inBraces = false
+				buf.UnreadByte()
+			}
+		}
+	}
+	inBraces = false
+	flush()
+	return res.String()
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/sql_go17.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/sql_go17.go
new file mode 100644
index 00000000..2690e001
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/sql_go17.go
@@ -0,0 +1,183 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+// +build !go1.8
+
+package xray
+
+import (
+	"context"
+	"database/sql"
+)
+
+// Begin starts a transaction.
+func (db *DB) Begin(ctx context.Context, opts interface{}) (*Tx, error) {
+	tx, err := db.db.Begin()
+	return &Tx{db, tx}, err
+}
+
+// Prepare creates a prepared statement for later queries or executions.
+func (db *DB) Prepare(ctx context.Context, query string) (*Stmt, error) {
+	stmt, err := db.db.Prepare(query)
+	return &Stmt{db, stmt, query}, err
+}
+
+// Ping traces verifying a connection to the database is still alive,
+// establishing a connection if necessary and adds corresponding information into subsegment.
+func (db *DB) Ping(ctx context.Context) error {
+	return Capture(ctx, db.dbname, func(ctx context.Context) error {
+		db.populate(ctx, "PING")
+		return db.db.Ping()
+	})
+}
+
+// Exec captures executing a query without returning any rows and
+// adds corresponding information into subsegment.
+func (db *DB) Exec(ctx context.Context, query string, args ...interface{}) (sql.Result, error) {
+	var res sql.Result
+
+	err := Capture(ctx, db.dbname, func(ctx context.Context) error {
+		db.populate(ctx, query)
+
+		var err error
+		res, err = db.db.Exec(query, args...)
+		return err
+	})
+
+	return res, err
+}
+
+// Query captures executing a query that returns rows and adds corresponding information into subsegment.
+func (db *DB) Query(ctx context.Context, query string, args ...interface{}) (*sql.Rows, error) {
+	var res *sql.Rows
+
+	err := Capture(ctx, db.dbname, func(ctx context.Context) error {
+		db.populate(ctx, query)
+
+		var err error
+		res, err = db.db.Query(query, args...)
+		return err
+	})
+
+	return res, err
+}
+
+// QueryRow captures executing a query that is expected to return at most one row
+// and adds corresponding information into subsegment.
+func (db *DB) QueryRow(ctx context.Context, query string, args ...interface{}) *sql.Row {
+	var res *sql.Row
+
+	Capture(ctx, db.dbname, func(ctx context.Context) error {
+		db.populate(ctx, query)
+
+		res = db.db.QueryRow(query, args...)
+		return nil
+	})
+
+	return res
+}
+
+// Exec captures executing a query that doesn't return rows and adds
+// corresponding information into subsegment.
+func (tx *Tx) Exec(ctx context.Context, query string, args ...interface{}) (sql.Result, error) {
+	var res sql.Result
+
+	err := Capture(ctx, tx.db.dbname, func(ctx context.Context) error {
+		tx.db.populate(ctx, query)
+
+		var err error
+		res, err = tx.tx.Exec(query, args...)
+		return err
+	})
+
+	return res, err
+}
+
+// Query captures executing a query that returns rows and adds corresponding information into subsegment.
+func (tx *Tx) Query(ctx context.Context, query string, args ...interface{}) (*sql.Rows, error) {
+	var res *sql.Rows
+
+	err := Capture(ctx, tx.db.dbname, func(ctx context.Context) error {
+		tx.db.populate(ctx, query)
+
+		var err error
+		res, err = tx.tx.Query(query, args...)
+		return err
+	})
+
+	return res, err
+}
+
+// QueryRow captures executing a query that is expected to return at most one row and adds
+// corresponding information into subsegment.
+func (tx *Tx) QueryRow(ctx context.Context, query string, args ...interface{}) *sql.Row {
+	var res *sql.Row
+
+	Capture(ctx, tx.db.dbname, func(ctx context.Context) error {
+		tx.db.populate(ctx, query)
+
+		res = tx.tx.QueryRow(query, args...)
+		return nil
+	})
+
+	return res
+}
+
+// Stmt returns a transaction-specific prepared statement from an existing statement.
+func (tx *Tx) Stmt(ctx context.Context, stmt *Stmt) *Stmt {
+	return &Stmt{stmt.db, tx.tx.Stmt(stmt.stmt), stmt.query}
+}
+
+// Exec captures executing a prepared statement with the given arguments and
+// returning a Result summarizing the effect of the statement and adds corresponding
+// information into subsegment.
+func (stmt *Stmt) Exec(ctx context.Context, args ...interface{}) (sql.Result, error) {
+	var res sql.Result
+
+	err := Capture(ctx, stmt.db.dbname, func(ctx context.Context) error {
+		stmt.populate(ctx, stmt.query)
+
+		var err error
+		res, err = stmt.stmt.Exec(args...)
+		return err
+	})
+
+	return res, err
+}
+
+// Query captures executing a prepared query statement with the given arguments
+// and returning the query results as a *Rows and adds corresponding information
+// into subsegment.
+func (stmt *Stmt) Query(ctx context.Context, args ...interface{}) (*sql.Rows, error) {
+	var res *sql.Rows
+
+	err := Capture(ctx, stmt.db.dbname, func(ctx context.Context) error {
+		stmt.populate(ctx, stmt.query)
+
+		var err error
+		res, err = stmt.stmt.Query(args...)
+		return err
+	})
+
+	return res, err
+}
+
+// QueryRow captures executing a prepared query statement with the given arguments and
+// adds corresponding information into subsegment.
+func (stmt *Stmt) QueryRow(ctx context.Context, args ...interface{}) *sql.Row {
+	var res *sql.Row
+
+	Capture(ctx, stmt.db.dbname, func(ctx context.Context) error {
+		stmt.populate(ctx, stmt.query)
+
+		res = stmt.stmt.QueryRow(args...)
+		return nil
+	})
+
+	return res
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/sql_go18.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/sql_go18.go
new file mode 100644
index 00000000..2ee0e30c
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/sql_go18.go
@@ -0,0 +1,183 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+// +build go1.8
+
+package xray
+
+import (
+	"context"
+	"database/sql"
+)
+
+// Begin starts a transaction.
+func (db *DB) Begin(ctx context.Context, opts *sql.TxOptions) (*Tx, error) {
+	tx, err := db.db.BeginTx(ctx, opts)
+	return &Tx{db, tx}, err
+}
+
+// Prepare creates a prepared statement for later queries or executions.
+func (db *DB) Prepare(ctx context.Context, query string) (*Stmt, error) {
+	stmt, err := db.db.PrepareContext(ctx, query)
+	return &Stmt{db, stmt, query}, err
+}
+
+// Ping traces verifying a connection to the database is still alive,
+// establishing a connection if necessary and adds corresponding information into subsegment.
+func (db *DB) Ping(ctx context.Context) error {
+	return Capture(ctx, db.dbname, func(ctx context.Context) error {
+		db.populate(ctx, "PING")
+		return db.db.PingContext(ctx)
+	})
+}
+
+// Exec captures executing a query without returning any rows and
+// adds corresponding information into subsegment.
+func (db *DB) Exec(ctx context.Context, query string, args ...interface{}) (sql.Result, error) {
+	var res sql.Result
+
+	err := Capture(ctx, db.dbname, func(ctx context.Context) error {
+		db.populate(ctx, query)
+
+		var err error
+		res, err = db.db.ExecContext(ctx, query, args...)
+		return err
+	})
+
+	return res, err
+}
+
+// Query captures executing a query that returns rows and adds corresponding information into subsegment.
+func (db *DB) Query(ctx context.Context, query string, args ...interface{}) (*sql.Rows, error) {
+	var res *sql.Rows
+
+	err := Capture(ctx, db.dbname, func(ctx context.Context) error {
+		db.populate(ctx, query)
+
+		var err error
+		res, err = db.db.QueryContext(ctx, query, args...)
+		return err
+	})
+
+	return res, err
+}
+
+// QueryRow captures executing a query that is expected to return at most one row
+// and adds corresponding information into subsegment.
+func (db *DB) QueryRow(ctx context.Context, query string, args ...interface{}) *sql.Row {
+	var res *sql.Row
+
+	Capture(ctx, db.dbname, func(ctx context.Context) error {
+		db.populate(ctx, query)
+
+		res = db.db.QueryRowContext(ctx, query, args...)
+		return nil
+	})
+
+	return res
+}
+
+// Exec captures executing a query that doesn't return rows and adds
+// corresponding information into subsegment.
+func (tx *Tx) Exec(ctx context.Context, query string, args ...interface{}) (sql.Result, error) {
+	var res sql.Result
+
+	err := Capture(ctx, tx.db.dbname, func(ctx context.Context) error {
+		tx.db.populate(ctx, query)
+
+		var err error
+		res, err = tx.tx.ExecContext(ctx, query, args...)
+		return err
+	})
+
+	return res, err
+}
+
+// Query captures executing a query that returns rows and adds corresponding information into subsegment.
+func (tx *Tx) Query(ctx context.Context, query string, args ...interface{}) (*sql.Rows, error) {
+	var res *sql.Rows
+
+	err := Capture(ctx, tx.db.dbname, func(ctx context.Context) error {
+		tx.db.populate(ctx, query)
+
+		var err error
+		res, err = tx.tx.QueryContext(ctx, query, args...)
+		return err
+	})
+
+	return res, err
+}
+
+// QueryRow captures executing a query that is expected to return at most one row and adds
+// corresponding information into subsegment.
+func (tx *Tx) QueryRow(ctx context.Context, query string, args ...interface{}) *sql.Row {
+	var res *sql.Row
+
+	Capture(ctx, tx.db.dbname, func(ctx context.Context) error {
+		tx.db.populate(ctx, query)
+
+		res = tx.tx.QueryRowContext(ctx, query, args...)
+		return nil
+	})
+
+	return res
+}
+
+// Stmt returns a transaction-specific prepared statement from an existing statement.
+func (tx *Tx) Stmt(ctx context.Context, stmt *Stmt) *Stmt {
+	return &Stmt{stmt.db, tx.tx.StmtContext(ctx, stmt.stmt), stmt.query}
+}
+
+// Exec captures executing a prepared statement with the given arguments and
+// returning a Result summarizing the effect of the statement and adds corresponding
+// information into subsegment.
+func (stmt *Stmt) Exec(ctx context.Context, args ...interface{}) (sql.Result, error) {
+	var res sql.Result
+
+	err := Capture(ctx, stmt.db.dbname, func(ctx context.Context) error {
+		stmt.populate(ctx, stmt.query)
+
+		var err error
+		res, err = stmt.stmt.ExecContext(ctx, args...)
+		return err
+	})
+
+	return res, err
+}
+
+// Query captures executing a prepared query statement with the given arguments
+// and returning the query results as a *Rows and adds corresponding information
+// into subsegment.
+func (stmt *Stmt) Query(ctx context.Context, args ...interface{}) (*sql.Rows, error) {
+	var res *sql.Rows
+
+	err := Capture(ctx, stmt.db.dbname, func(ctx context.Context) error {
+		stmt.populate(ctx, stmt.query)
+
+		var err error
+		res, err = stmt.stmt.QueryContext(ctx, args...)
+		return err
+	})
+
+	return res, err
+}
+
+// QueryRow captures executing a prepared query statement with the given arguments and
+// adds corresponding information into subsegment.
+func (stmt *Stmt) QueryRow(ctx context.Context, args ...interface{}) *sql.Row {
+	var res *sql.Row
+
+	Capture(ctx, stmt.db.dbname, func(ctx context.Context) error {
+		stmt.populate(ctx, stmt.query)
+
+		res = stmt.stmt.QueryRowContext(ctx, args...)
+		return nil
+	})
+
+	return res
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/streaming_strategy.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/streaming_strategy.go
new file mode 100644
index 00000000..9f88174a
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/aws/aws-xray-sdk-go/xray/streaming_strategy.go
@@ -0,0 +1,15 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+// StreamingStrategy provides an interface for implementing streaming strategies.
+type StreamingStrategy interface {
+	RequiresStreaming(seg *Segment) bool
+	StreamCompletedSubsegments(seg *Segment) [][]byte
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/LICENSE.txt b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/LICENSE.txt
new file mode 100644
index 00000000..8c706814
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/LICENSE.txt
@@ -0,0 +1,24 @@
+Copyright (c) 2012, Cloud Instruments Co., Ltd. <info@cin.io>
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * Neither the name of the Cloud Instruments Co., Ltd. nor the
+      names of its contributors may be used to endorse or promote products
+      derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/README.markdown b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/README.markdown
new file mode 100644
index 00000000..b9acd2d1
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/README.markdown
@@ -0,0 +1,113 @@
+Seelog
+=======
+
+Seelog is a powerful and easy-to-learn logging framework that provides functionality for flexible dispatching, filtering, and formatting log messages.
+It is natively written in the [Go](http://golang.org/) programming language. 
+
+[![Build Status](https://drone.io/github.com/cihub/seelog/status.png)](https://drone.io/github.com/cihub/seelog/latest)
+
+Features
+------------------
+
+* Xml configuring to be able to change logger parameters without recompilation
+* Changing configurations on the fly without app restart
+* Possibility to set different log configurations for different project files and functions
+* Adjustable message formatting
+* Simultaneous log output to multiple streams
+* Choosing logger priority strategy to minimize performance hit
+* Different output writers
+  * Console writer
+  * File writer 
+  * Buffered writer (Chunk writer)
+  * Rolling log writer (Logging with rotation)
+  * SMTP writer
+  * Others... (See [Wiki](https://github.com/cihub/seelog/wiki))
+* Log message wrappers (JSON, XML, etc.)
+* Global variables and functions for easy usage in standalone apps
+* Functions for flexible usage in libraries
+
+Quick-start
+-----------
+
+```go
+package main
+
+import log "github.com/cihub/seelog"
+
+func main() {
+    defer log.Flush()
+    log.Info("Hello from Seelog!")
+}
+```
+
+Installation
+------------
+
+If you don't have the Go development environment installed, visit the 
+[Getting Started](http://golang.org/doc/install.html) document and follow the instructions. Once you're ready, execute the following command:
+
+```
+go get -u github.com/cihub/seelog
+```
+
+*IMPORTANT*: If you are not using the latest release version of Go, check out this [wiki page](https://github.com/cihub/seelog/wiki/Notes-on-'go-get')
+
+Documentation
+---------------
+
+Seelog has github wiki pages, which contain detailed how-tos references: https://github.com/cihub/seelog/wiki
+
+Examples
+---------------
+
+Seelog examples can be found here: [seelog-examples](https://github.com/cihub/seelog-examples)
+
+Issues
+---------------
+
+Feel free to push issues that could make Seelog better: https://github.com/cihub/seelog/issues
+
+Changelog
+---------------
+
+* **v2.5** : Interaction with other systems. Part 2: custom receivers
+    * Finished custom receivers feature. Check [wiki](https://github.com/cihub/seelog/wiki/custom-receivers)
+    * Added 'LoggerFromCustomReceiver'
+    * Added 'LoggerFromWriterWithMinLevelAndFormat'
+    * Added 'LoggerFromCustomReceiver'
+    * Added 'LoggerFromParamConfigAs...' 
+* **v2.4** : Interaction with other systems. Part 1: wrapping seelog
+    * Added configurable caller stack skip logic
+    * Added 'SetAdditionalStackDepth' to 'LoggerInterface'
+* **v2.3** : Rethinking 'rolling' receiver
+    * Reimplemented 'rolling' receiver
+    * Added 'Max rolls' feature for 'rolling' receiver with type='date'
+    * Fixed 'rolling' receiver issue: renaming on Windows
+* **v2.2** : go1.0 compatibility point [go1.0 tag]
+    * Fixed internal bugs
+    * Added 'ANSI n [;k]' format identifier:  %EscN
+    * Made current release go1 compatible 
+* **v2.1** : Some new features
+    * Rolling receiver archiving option.
+    * Added format identifier: %Line
+    * Smtp: added paths to PEM files directories
+    * Added format identifier: %FuncShort
+    * Warn, Error and Critical methods now return an error
+* **v2.0** : Second major release. BREAKING CHANGES.
+    * Support of binaries with stripped symbols
+    * Added log strategy: adaptive
+    * Critical message now forces Flush()
+    * Added predefined formats: xml-debug, xml-debug-short, xml, xml-short, json-debug, json-debug-short, json, json-short, debug, debug-short, fast
+    * Added receiver: conn (network connection writer)
+    * BREAKING CHANGE: added Tracef, Debugf, Infof, etc. to satisfy the print/printf principle
+    * Bug fixes
+* **v1.0** : Initial release. Features:
+    * Xml config
+    * Changing configurations on the fly without app restart
+    * Contraints and exceptions
+    * Formatting
+    * Log strategies: sync, async loop, async timer
+    * Receivers: buffered, console, file, rolling, smtp
+
+
+
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/behavior_adaptivelogger.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/behavior_adaptivelogger.go
new file mode 100644
index 00000000..0c640cae
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/behavior_adaptivelogger.go
@@ -0,0 +1,129 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"errors"
+	"fmt"
+	"math"
+	"time"
+)
+
+var (
+	adaptiveLoggerMaxInterval         = time.Minute
+	adaptiveLoggerMaxCriticalMsgCount = uint32(1000)
+)
+
+// asyncAdaptiveLogger represents asynchronous adaptive logger which acts like
+// an async timer logger, but its interval depends on the current message count
+// in the queue.
+//
+// Interval = I, minInterval = m, maxInterval = M, criticalMsgCount = C, msgCount = c:
+// I = m + (C - Min(c, C)) / C * (M - m)
+type asyncAdaptiveLogger struct {
+	asyncLogger
+	minInterval      time.Duration
+	criticalMsgCount uint32
+	maxInterval      time.Duration
+}
+
+// NewAsyncLoopLogger creates a new asynchronous adaptive logger
+func NewAsyncAdaptiveLogger(
+	config *logConfig,
+	minInterval time.Duration,
+	maxInterval time.Duration,
+	criticalMsgCount uint32) (*asyncAdaptiveLogger, error) {
+
+	if minInterval <= 0 {
+		return nil, errors.New("async adaptive logger min interval should be > 0")
+	}
+
+	if maxInterval > adaptiveLoggerMaxInterval {
+		return nil, fmt.Errorf("async adaptive logger max interval should be <= %s",
+			adaptiveLoggerMaxInterval)
+	}
+
+	if criticalMsgCount <= 0 {
+		return nil, errors.New("async adaptive logger critical msg count should be > 0")
+	}
+
+	if criticalMsgCount > adaptiveLoggerMaxCriticalMsgCount {
+		return nil, fmt.Errorf("async adaptive logger critical msg count should be <= %s",
+			adaptiveLoggerMaxInterval)
+	}
+
+	asnAdaptiveLogger := new(asyncAdaptiveLogger)
+
+	asnAdaptiveLogger.asyncLogger = *newAsyncLogger(config)
+	asnAdaptiveLogger.minInterval = minInterval
+	asnAdaptiveLogger.maxInterval = maxInterval
+	asnAdaptiveLogger.criticalMsgCount = criticalMsgCount
+
+	go asnAdaptiveLogger.processQueue()
+
+	return asnAdaptiveLogger, nil
+}
+
+func (asnAdaptiveLogger *asyncAdaptiveLogger) processItem() (closed bool, itemCount int) {
+	asnAdaptiveLogger.queueHasElements.L.Lock()
+	defer asnAdaptiveLogger.queueHasElements.L.Unlock()
+
+	for asnAdaptiveLogger.msgQueue.Len() == 0 && !asnAdaptiveLogger.Closed() {
+		asnAdaptiveLogger.queueHasElements.Wait()
+	}
+
+	if asnAdaptiveLogger.Closed() {
+		return true, asnAdaptiveLogger.msgQueue.Len()
+	}
+
+	asnAdaptiveLogger.processQueueElement()
+	return false, asnAdaptiveLogger.msgQueue.Len() - 1
+}
+
+// I = m + (C - Min(c, C)) / C * (M - m) =>
+// I = m + cDiff * mDiff,
+// 		cDiff = (C - Min(c, C)) / C)
+//		mDiff = (M - m)
+func (asnAdaptiveLogger *asyncAdaptiveLogger) calcAdaptiveInterval(msgCount int) time.Duration {
+	critCountF := float64(asnAdaptiveLogger.criticalMsgCount)
+	cDiff := (critCountF - math.Min(float64(msgCount), critCountF)) / critCountF
+	mDiff := float64(asnAdaptiveLogger.maxInterval - asnAdaptiveLogger.minInterval)
+
+	return asnAdaptiveLogger.minInterval + time.Duration(cDiff*mDiff)
+}
+
+func (asnAdaptiveLogger *asyncAdaptiveLogger) processQueue() {
+	for !asnAdaptiveLogger.Closed() {
+		closed, itemCount := asnAdaptiveLogger.processItem()
+
+		if closed {
+			break
+		}
+
+		interval := asnAdaptiveLogger.calcAdaptiveInterval(itemCount)
+
+		<-time.After(interval)
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/behavior_asynclogger.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/behavior_asynclogger.go
new file mode 100644
index 00000000..75231067
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/behavior_asynclogger.go
@@ -0,0 +1,142 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"container/list"
+	"fmt"
+	"sync"
+)
+
+// MaxQueueSize is the critical number of messages in the queue that result in an immediate flush.
+const (
+	MaxQueueSize = 10000
+)
+
+type msgQueueItem struct {
+	level   LogLevel
+	context LogContextInterface
+	message fmt.Stringer
+}
+
+// asyncLogger represents common data for all asynchronous loggers
+type asyncLogger struct {
+	commonLogger
+	msgQueue         *list.List
+	queueHasElements *sync.Cond
+}
+
+// newAsyncLogger creates a new asynchronous logger
+func newAsyncLogger(config *logConfig) *asyncLogger {
+	asnLogger := new(asyncLogger)
+
+	asnLogger.msgQueue = list.New()
+	asnLogger.queueHasElements = sync.NewCond(new(sync.Mutex))
+
+	asnLogger.commonLogger = *newCommonLogger(config, asnLogger)
+
+	return asnLogger
+}
+
+func (asnLogger *asyncLogger) innerLog(
+	level LogLevel,
+	context LogContextInterface,
+	message fmt.Stringer) {
+
+	asnLogger.addMsgToQueue(level, context, message)
+}
+
+func (asnLogger *asyncLogger) Close() {
+	asnLogger.m.Lock()
+	defer asnLogger.m.Unlock()
+
+	if !asnLogger.Closed() {
+		asnLogger.flushQueue(true)
+		asnLogger.config.RootDispatcher.Flush()
+
+		if err := asnLogger.config.RootDispatcher.Close(); err != nil {
+			reportInternalError(err)
+		}
+
+		asnLogger.closedM.Lock()
+		asnLogger.closed = true
+		asnLogger.closedM.Unlock()
+		asnLogger.queueHasElements.Broadcast()
+	}
+}
+
+func (asnLogger *asyncLogger) Flush() {
+	asnLogger.m.Lock()
+	defer asnLogger.m.Unlock()
+
+	if !asnLogger.Closed() {
+		asnLogger.flushQueue(true)
+		asnLogger.config.RootDispatcher.Flush()
+	}
+}
+
+func (asnLogger *asyncLogger) flushQueue(lockNeeded bool) {
+	if lockNeeded {
+		asnLogger.queueHasElements.L.Lock()
+		defer asnLogger.queueHasElements.L.Unlock()
+	}
+
+	for asnLogger.msgQueue.Len() > 0 {
+		asnLogger.processQueueElement()
+	}
+}
+
+func (asnLogger *asyncLogger) processQueueElement() {
+	if asnLogger.msgQueue.Len() > 0 {
+		backElement := asnLogger.msgQueue.Front()
+		msg, _ := backElement.Value.(msgQueueItem)
+		asnLogger.processLogMsg(msg.level, msg.message, msg.context)
+		asnLogger.msgQueue.Remove(backElement)
+	}
+}
+
+func (asnLogger *asyncLogger) addMsgToQueue(
+	level LogLevel,
+	context LogContextInterface,
+	message fmt.Stringer) {
+
+	if !asnLogger.Closed() {
+		asnLogger.queueHasElements.L.Lock()
+		defer asnLogger.queueHasElements.L.Unlock()
+
+		if asnLogger.msgQueue.Len() >= MaxQueueSize {
+			fmt.Printf("Seelog queue overflow: more than %v messages in the queue. Flushing.\n", MaxQueueSize)
+			asnLogger.flushQueue(false)
+		}
+
+		queueItem := msgQueueItem{level, context, message}
+
+		asnLogger.msgQueue.PushBack(queueItem)
+		asnLogger.queueHasElements.Broadcast()
+	} else {
+		err := fmt.Errorf("queue closed! Cannot process element: %d %#v", level, message)
+		reportInternalError(err)
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/behavior_asynclooplogger.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/behavior_asynclooplogger.go
new file mode 100644
index 00000000..972467b3
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/behavior_asynclooplogger.go
@@ -0,0 +1,69 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+// asyncLoopLogger represents asynchronous logger which processes the log queue in
+// a 'for' loop
+type asyncLoopLogger struct {
+	asyncLogger
+}
+
+// NewAsyncLoopLogger creates a new asynchronous loop logger
+func NewAsyncLoopLogger(config *logConfig) *asyncLoopLogger {
+
+	asnLoopLogger := new(asyncLoopLogger)
+
+	asnLoopLogger.asyncLogger = *newAsyncLogger(config)
+
+	go asnLoopLogger.processQueue()
+
+	return asnLoopLogger
+}
+
+func (asnLoopLogger *asyncLoopLogger) processItem() (closed bool) {
+	asnLoopLogger.queueHasElements.L.Lock()
+	defer asnLoopLogger.queueHasElements.L.Unlock()
+
+	for asnLoopLogger.msgQueue.Len() == 0 && !asnLoopLogger.Closed() {
+		asnLoopLogger.queueHasElements.Wait()
+	}
+
+	if asnLoopLogger.Closed() {
+		return true
+	}
+
+	asnLoopLogger.processQueueElement()
+	return false
+}
+
+func (asnLoopLogger *asyncLoopLogger) processQueue() {
+	for !asnLoopLogger.Closed() {
+		closed := asnLoopLogger.processItem()
+
+		if closed {
+			break
+		}
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/behavior_asynctimerlogger.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/behavior_asynctimerlogger.go
new file mode 100644
index 00000000..8118f205
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/behavior_asynctimerlogger.go
@@ -0,0 +1,82 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"errors"
+	"time"
+)
+
+// asyncTimerLogger represents asynchronous logger which processes the log queue each
+// 'duration' nanoseconds
+type asyncTimerLogger struct {
+	asyncLogger
+	interval time.Duration
+}
+
+// NewAsyncLoopLogger creates a new asynchronous loop logger
+func NewAsyncTimerLogger(config *logConfig, interval time.Duration) (*asyncTimerLogger, error) {
+
+	if interval <= 0 {
+		return nil, errors.New("async logger interval should be > 0")
+	}
+
+	asnTimerLogger := new(asyncTimerLogger)
+
+	asnTimerLogger.asyncLogger = *newAsyncLogger(config)
+	asnTimerLogger.interval = interval
+
+	go asnTimerLogger.processQueue()
+
+	return asnTimerLogger, nil
+}
+
+func (asnTimerLogger *asyncTimerLogger) processItem() (closed bool) {
+	asnTimerLogger.queueHasElements.L.Lock()
+	defer asnTimerLogger.queueHasElements.L.Unlock()
+
+	for asnTimerLogger.msgQueue.Len() == 0 && !asnTimerLogger.Closed() {
+		asnTimerLogger.queueHasElements.Wait()
+	}
+
+	if asnTimerLogger.Closed() {
+		return true
+	}
+
+	asnTimerLogger.processQueueElement()
+	return false
+}
+
+func (asnTimerLogger *asyncTimerLogger) processQueue() {
+	for !asnTimerLogger.Closed() {
+		closed := asnTimerLogger.processItem()
+
+		if closed {
+			break
+		}
+
+		<-time.After(asnTimerLogger.interval)
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/behavior_synclogger.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/behavior_synclogger.go
new file mode 100644
index 00000000..5a022ebc
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/behavior_synclogger.go
@@ -0,0 +1,75 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"fmt"
+)
+
+// syncLogger performs logging in the same goroutine where 'Trace/Debug/...'
+// func was called
+type syncLogger struct {
+	commonLogger
+}
+
+// NewSyncLogger creates a new synchronous logger
+func NewSyncLogger(config *logConfig) *syncLogger {
+	syncLogger := new(syncLogger)
+
+	syncLogger.commonLogger = *newCommonLogger(config, syncLogger)
+
+	return syncLogger
+}
+
+func (syncLogger *syncLogger) innerLog(
+	level LogLevel,
+	context LogContextInterface,
+	message fmt.Stringer) {
+
+	syncLogger.processLogMsg(level, message, context)
+}
+
+func (syncLogger *syncLogger) Close() {
+	syncLogger.m.Lock()
+	defer syncLogger.m.Unlock()
+
+	if !syncLogger.Closed() {
+		if err := syncLogger.config.RootDispatcher.Close(); err != nil {
+			reportInternalError(err)
+		}
+		syncLogger.closedM.Lock()
+		syncLogger.closed = true
+		syncLogger.closedM.Unlock()
+	}
+}
+
+func (syncLogger *syncLogger) Flush() {
+	syncLogger.m.Lock()
+	defer syncLogger.m.Unlock()
+
+	if !syncLogger.Closed() {
+		syncLogger.config.RootDispatcher.Flush()
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/cfg_config.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/cfg_config.go
new file mode 100644
index 00000000..c7d84812
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/cfg_config.go
@@ -0,0 +1,188 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"bytes"
+	"encoding/xml"
+	"io"
+	"os"
+)
+
+// LoggerFromConfigAsFile creates logger with config from file. File should contain valid seelog xml.
+func LoggerFromConfigAsFile(fileName string) (LoggerInterface, error) {
+	file, err := os.Open(fileName)
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close()
+
+	conf, err := configFromReader(file)
+	if err != nil {
+		return nil, err
+	}
+
+	return createLoggerFromFullConfig(conf)
+}
+
+// LoggerFromConfigAsBytes creates a logger with config from bytes stream. Bytes should contain valid seelog xml.
+func LoggerFromConfigAsBytes(data []byte) (LoggerInterface, error) {
+	conf, err := configFromReader(bytes.NewBuffer(data))
+	if err != nil {
+		return nil, err
+	}
+
+	return createLoggerFromFullConfig(conf)
+}
+
+// LoggerFromConfigAsString creates a logger with config from a string. String should contain valid seelog xml.
+func LoggerFromConfigAsString(data string) (LoggerInterface, error) {
+	return LoggerFromConfigAsBytes([]byte(data))
+}
+
+// LoggerFromParamConfigAsFile does the same as LoggerFromConfigAsFile, but includes special parser options.
+// See 'CfgParseParams' comments.
+func LoggerFromParamConfigAsFile(fileName string, parserParams *CfgParseParams) (LoggerInterface, error) {
+	file, err := os.Open(fileName)
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close()
+
+	conf, err := configFromReaderWithConfig(file, parserParams)
+	if err != nil {
+		return nil, err
+	}
+
+	return createLoggerFromFullConfig(conf)
+}
+
+// LoggerFromParamConfigAsBytes does the same as LoggerFromConfigAsBytes, but includes special parser options.
+// See 'CfgParseParams' comments.
+func LoggerFromParamConfigAsBytes(data []byte, parserParams *CfgParseParams) (LoggerInterface, error) {
+	conf, err := configFromReaderWithConfig(bytes.NewBuffer(data), parserParams)
+	if err != nil {
+		return nil, err
+	}
+
+	return createLoggerFromFullConfig(conf)
+}
+
+// LoggerFromParamConfigAsString does the same as LoggerFromConfigAsString, but includes special parser options.
+// See 'CfgParseParams' comments.
+func LoggerFromParamConfigAsString(data string, parserParams *CfgParseParams) (LoggerInterface, error) {
+	return LoggerFromParamConfigAsBytes([]byte(data), parserParams)
+}
+
+// LoggerFromWriterWithMinLevel is shortcut for LoggerFromWriterWithMinLevelAndFormat(output, minLevel, DefaultMsgFormat)
+func LoggerFromWriterWithMinLevel(output io.Writer, minLevel LogLevel) (LoggerInterface, error) {
+	return LoggerFromWriterWithMinLevelAndFormat(output, minLevel, DefaultMsgFormat)
+}
+
+// LoggerFromWriterWithMinLevelAndFormat creates a proxy logger that uses io.Writer as the
+// receiver with minimal level = minLevel and with specified format.
+//
+// All messages with level more or equal to minLevel will be written to output and
+// formatted using the default seelog format.
+//
+// Can be called for usage with non-Seelog systems
+func LoggerFromWriterWithMinLevelAndFormat(output io.Writer, minLevel LogLevel, format string) (LoggerInterface, error) {
+	constraints, err := NewMinMaxConstraints(minLevel, CriticalLvl)
+	if err != nil {
+		return nil, err
+	}
+	formatter, err := NewFormatter(format)
+	if err != nil {
+		return nil, err
+	}
+	dispatcher, err := NewSplitDispatcher(formatter, []interface{}{output})
+	if err != nil {
+		return nil, err
+	}
+
+	conf, err := newFullLoggerConfig(constraints, make([]*LogLevelException, 0), dispatcher, syncloggerTypeFromString, nil, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return createLoggerFromFullConfig(conf)
+}
+
+// LoggerFromXMLDecoder creates logger with config from a XML decoder starting from a specific node.
+// It should contain valid seelog xml, except for root node name.
+func LoggerFromXMLDecoder(xmlParser *xml.Decoder, rootNode xml.Token) (LoggerInterface, error) {
+	conf, err := configFromXMLDecoder(xmlParser, rootNode)
+	if err != nil {
+		return nil, err
+	}
+
+	return createLoggerFromFullConfig(conf)
+}
+
+// LoggerFromCustomReceiver creates a proxy logger that uses a CustomReceiver as the
+// receiver.
+//
+// All messages will be sent to the specified custom receiver without additional
+// formatting ('%Msg' format is used).
+//
+// Check CustomReceiver, RegisterReceiver for additional info.
+//
+// NOTE 1: CustomReceiver.AfterParse is only called when a receiver is instantiated
+// by the config parser while parsing config. So, if you are not planning to use the
+// same CustomReceiver for both proxying (via LoggerFromCustomReceiver call) and
+// loading from config, just leave AfterParse implementation empty.
+//
+// NOTE 2: Unlike RegisterReceiver, LoggerFromCustomReceiver takes an already initialized
+// instance that implements CustomReceiver. So, fill it with data and perform any initialization
+// logic before calling this func and it won't be lost.
+//
+// So:
+// * RegisterReceiver takes value just to get the reflect.Type from it and then
+// instantiate it as many times as config is reloaded.
+//
+// * LoggerFromCustomReceiver takes value and uses it without modification and
+// reinstantiation, directy passing it to the dispatcher tree.
+func LoggerFromCustomReceiver(receiver CustomReceiver) (LoggerInterface, error) {
+	constraints, err := NewMinMaxConstraints(TraceLvl, CriticalLvl)
+	if err != nil {
+		return nil, err
+	}
+
+	output, err := NewCustomReceiverDispatcherByValue(msgonlyformatter, receiver, "user-proxy", CustomReceiverInitArgs{})
+	if err != nil {
+		return nil, err
+	}
+	dispatcher, err := NewSplitDispatcher(msgonlyformatter, []interface{}{output})
+	if err != nil {
+		return nil, err
+	}
+
+	conf, err := newFullLoggerConfig(constraints, make([]*LogLevelException, 0), dispatcher, syncloggerTypeFromString, nil, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return createLoggerFromFullConfig(conf)
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/cfg_errors.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/cfg_errors.go
new file mode 100644
index 00000000..c1fb4d10
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/cfg_errors.go
@@ -0,0 +1,61 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"errors"
+)
+
+var (
+	errNodeMustHaveChildren   = errors.New("node must have children")
+	errNodeCannotHaveChildren = errors.New("node cannot have children")
+)
+
+type unexpectedChildElementError struct {
+	baseError
+}
+
+func newUnexpectedChildElementError(msg string) *unexpectedChildElementError {
+	custmsg := "Unexpected child element: " + msg
+	return &unexpectedChildElementError{baseError{message: custmsg}}
+}
+
+type missingArgumentError struct {
+	baseError
+}
+
+func newMissingArgumentError(nodeName, attrName string) *missingArgumentError {
+	custmsg := "Output '" + nodeName + "' has no '" + attrName + "' attribute"
+	return &missingArgumentError{baseError{message: custmsg}}
+}
+
+type unexpectedAttributeError struct {
+	baseError
+}
+
+func newUnexpectedAttributeError(nodeName, attr string) *unexpectedAttributeError {
+	custmsg := nodeName + " has unexpected attribute: " + attr
+	return &unexpectedAttributeError{baseError{message: custmsg}}
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/cfg_logconfig.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/cfg_logconfig.go
new file mode 100644
index 00000000..6ba6f9a9
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/cfg_logconfig.go
@@ -0,0 +1,141 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"errors"
+)
+
+type loggerTypeFromString uint8
+
+const (
+	syncloggerTypeFromString = iota
+	asyncLooploggerTypeFromString
+	asyncTimerloggerTypeFromString
+	adaptiveLoggerTypeFromString
+	defaultloggerTypeFromString = asyncLooploggerTypeFromString
+)
+
+const (
+	syncloggerTypeFromStringStr       = "sync"
+	asyncloggerTypeFromStringStr      = "asyncloop"
+	asyncTimerloggerTypeFromStringStr = "asynctimer"
+	adaptiveLoggerTypeFromStringStr   = "adaptive"
+)
+
+// asyncTimerLoggerData represents specific data for async timer logger
+type asyncTimerLoggerData struct {
+	AsyncInterval uint32
+}
+
+// adaptiveLoggerData represents specific data for adaptive timer logger
+type adaptiveLoggerData struct {
+	MinInterval      uint32
+	MaxInterval      uint32
+	CriticalMsgCount uint32
+}
+
+var loggerTypeToStringRepresentations = map[loggerTypeFromString]string{
+	syncloggerTypeFromString:       syncloggerTypeFromStringStr,
+	asyncLooploggerTypeFromString:  asyncloggerTypeFromStringStr,
+	asyncTimerloggerTypeFromString: asyncTimerloggerTypeFromStringStr,
+	adaptiveLoggerTypeFromString:   adaptiveLoggerTypeFromStringStr,
+}
+
+// getLoggerTypeFromString parses a string and returns a corresponding logger type, if successful.
+func getLoggerTypeFromString(logTypeString string) (level loggerTypeFromString, found bool) {
+	for logType, logTypeStr := range loggerTypeToStringRepresentations {
+		if logTypeStr == logTypeString {
+			return logType, true
+		}
+	}
+
+	return 0, false
+}
+
+// logConfig stores logging configuration. Contains messages dispatcher, allowed log level rules
+// (general constraints and exceptions)
+type logConfig struct {
+	Constraints    logLevelConstraints  // General log level rules (>min and <max, or set of allowed levels)
+	Exceptions     []*LogLevelException // Exceptions to general rules for specific files or funcs
+	RootDispatcher dispatcherInterface  // Root of output tree
+}
+
+func NewLoggerConfig(c logLevelConstraints, e []*LogLevelException, d dispatcherInterface) *logConfig {
+	return &logConfig{c, e, d}
+}
+
+// configForParsing is used when parsing config from file: logger type is deduced from string, params
+// need to be converted from attributes to values and passed to specific logger constructor. Also,
+// custom registered receivers and other parse params are used in this case.
+type configForParsing struct {
+	logConfig
+	LogType    loggerTypeFromString
+	LoggerData interface{}
+	Params     *CfgParseParams // Check cfg_parser: CfgParseParams
+}
+
+func newFullLoggerConfig(
+	constraints logLevelConstraints,
+	exceptions []*LogLevelException,
+	rootDispatcher dispatcherInterface,
+	logType loggerTypeFromString,
+	logData interface{},
+	cfgParams *CfgParseParams) (*configForParsing, error) {
+	if constraints == nil {
+		return nil, errors.New("constraints can not be nil")
+	}
+	if rootDispatcher == nil {
+		return nil, errors.New("rootDispatcher can not be nil")
+	}
+
+	config := new(configForParsing)
+	config.Constraints = constraints
+	config.Exceptions = exceptions
+	config.RootDispatcher = rootDispatcher
+	config.LogType = logType
+	config.LoggerData = logData
+	config.Params = cfgParams
+
+	return config, nil
+}
+
+// IsAllowed returns true if logging with specified log level is allowed in current context.
+// If any of exception patterns match current context, then exception constraints are applied. Otherwise,
+// the general constraints are used.
+func (config *logConfig) IsAllowed(level LogLevel, context LogContextInterface) bool {
+	allowed := config.Constraints.IsAllowed(level) // General rule
+
+	// Exceptions:
+	if context.IsValid() {
+		for _, exception := range config.Exceptions {
+			if exception.MatchesContext(context) {
+				return exception.IsAllowed(level)
+			}
+		}
+	}
+
+	return allowed
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/cfg_parser.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/cfg_parser.go
new file mode 100644
index 00000000..7fb9aabf
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/cfg_parser.go
@@ -0,0 +1,1238 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"crypto/tls"
+	"encoding/xml"
+	"errors"
+	"fmt"
+	"io"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// Names of elements of seelog config.
+const (
+	seelogConfigID                   = "seelog"
+	outputsID                        = "outputs"
+	formatsID                        = "formats"
+	minLevelID                       = "minlevel"
+	maxLevelID                       = "maxlevel"
+	levelsID                         = "levels"
+	exceptionsID                     = "exceptions"
+	exceptionID                      = "exception"
+	funcPatternID                    = "funcpattern"
+	filePatternID                    = "filepattern"
+	formatID                         = "format"
+	formatAttrID                     = "format"
+	formatKeyAttrID                  = "id"
+	outputFormatID                   = "formatid"
+	pathID                           = "path"
+	fileWriterID                     = "file"
+	smtpWriterID                     = "smtp"
+	senderaddressID                  = "senderaddress"
+	senderNameID                     = "sendername"
+	recipientID                      = "recipient"
+	mailHeaderID                     = "header"
+	mailHeaderNameID                 = "name"
+	mailHeaderValueID                = "value"
+	addressID                        = "address"
+	hostNameID                       = "hostname"
+	hostPortID                       = "hostport"
+	userNameID                       = "username"
+	userPassID                       = "password"
+	cACertDirpathID                  = "cacertdirpath"
+	subjectID                        = "subject"
+	splitterDispatcherID             = "splitter"
+	consoleWriterID                  = "console"
+	customReceiverID                 = "custom"
+	customNameAttrID                 = "name"
+	customNameDataAttrPrefix         = "data-"
+	filterDispatcherID               = "filter"
+	filterLevelsAttrID               = "levels"
+	rollingfileWriterID              = "rollingfile"
+	rollingFileTypeAttr              = "type"
+	rollingFilePathAttr              = "filename"
+	rollingFileMaxSizeAttr           = "maxsize"
+	rollingFileMaxRollsAttr          = "maxrolls"
+	rollingFileNameModeAttr          = "namemode"
+	rollingFileDataPatternAttr       = "datepattern"
+	rollingFileArchiveAttr           = "archivetype"
+	rollingFileArchivePathAttr       = "archivepath"
+	bufferedWriterID                 = "buffered"
+	bufferedSizeAttr                 = "size"
+	bufferedFlushPeriodAttr          = "flushperiod"
+	loggerTypeFromStringAttr         = "type"
+	asyncLoggerIntervalAttr          = "asyncinterval"
+	adaptLoggerMinIntervalAttr       = "mininterval"
+	adaptLoggerMaxIntervalAttr       = "maxinterval"
+	adaptLoggerCriticalMsgCountAttr  = "critmsgcount"
+	predefinedPrefix                 = "std:"
+	connWriterID                     = "conn"
+	connWriterAddrAttr               = "addr"
+	connWriterNetAttr                = "net"
+	connWriterReconnectOnMsgAttr     = "reconnectonmsg"
+	connWriterUseTLSAttr             = "tls"
+	connWriterInsecureSkipVerifyAttr = "insecureskipverify"
+)
+
+// CustomReceiverProducer is the signature of the function CfgParseParams needs to create
+// custom receivers.
+type CustomReceiverProducer func(CustomReceiverInitArgs) (CustomReceiver, error)
+
+// CfgParseParams represent specific parse options or flags used by parser. It is used if seelog parser needs
+// some special directives or additional info to correctly parse a config.
+type CfgParseParams struct {
+	// CustomReceiverProducers expose the same functionality as RegisterReceiver func
+	// but only in the scope (context) of the config parse func instead of a global package scope.
+	//
+	// It means that if you use custom receivers in your code, you may either register them globally once with
+	// RegisterReceiver or you may call funcs like LoggerFromParamConfigAsFile (with 'ParamConfig')
+	// and use CustomReceiverProducers to provide custom producer funcs.
+	//
+	// A producer func is called when config parser processes a '<custom>' element. It takes the 'name' attribute
+	// of the element and tries to find a match in two places:
+	// 1) CfgParseParams.CustomReceiverProducers map
+	// 2) Global type map, filled by RegisterReceiver
+	//
+	// If a match is found in the CustomReceiverProducers map, parser calls the corresponding producer func
+	// passing the init args to it.	The func takes exactly the same args as CustomReceiver.AfterParse.
+	// The producer func must return a correct receiver or an error. If case of error, seelog will behave
+	// in the same way as with any other config error.
+	//
+	// You may use this param to set custom producers in case you need to pass some context when instantiating
+	// a custom receiver or if you frequently change custom receivers with different parameters or in any other
+	// situation where package-level registering (RegisterReceiver) is not an option for you.
+	CustomReceiverProducers map[string]CustomReceiverProducer
+}
+
+func (cfg *CfgParseParams) String() string {
+	return fmt.Sprintf("CfgParams: {custom_recs=%d}", len(cfg.CustomReceiverProducers))
+}
+
+type elementMapEntry struct {
+	constructor func(node *xmlNode, formatFromParent *formatter, formats map[string]*formatter, cfg *CfgParseParams) (interface{}, error)
+}
+
+var elementMap map[string]elementMapEntry
+var predefinedFormats map[string]*formatter
+
+func init() {
+	elementMap = map[string]elementMapEntry{
+		fileWriterID:         {createfileWriter},
+		splitterDispatcherID: {createSplitter},
+		customReceiverID:     {createCustomReceiver},
+		filterDispatcherID:   {createFilter},
+		consoleWriterID:      {createConsoleWriter},
+		rollingfileWriterID:  {createRollingFileWriter},
+		bufferedWriterID:     {createbufferedWriter},
+		smtpWriterID:         {createSMTPWriter},
+		connWriterID:         {createconnWriter},
+	}
+
+	err := fillPredefinedFormats()
+	if err != nil {
+		panic(fmt.Sprintf("Seelog couldn't start: predefined formats creation failed. Error: %s", err.Error()))
+	}
+}
+
+func fillPredefinedFormats() error {
+	predefinedFormatsWithoutPrefix := map[string]string{
+		"xml-debug":       `<time>%Ns</time><lev>%Lev</lev><msg>%Msg</msg><path>%RelFile</path><func>%Func</func><line>%Line</line>`,
+		"xml-debug-short": `<t>%Ns</t><l>%l</l><m>%Msg</m><p>%RelFile</p><f>%Func</f>`,
+		"xml":             `<time>%Ns</time><lev>%Lev</lev><msg>%Msg</msg>`,
+		"xml-short":       `<t>%Ns</t><l>%l</l><m>%Msg</m>`,
+
+		"json-debug":       `{"time":%Ns,"lev":"%Lev","msg":"%Msg","path":"%RelFile","func":"%Func","line":"%Line"}`,
+		"json-debug-short": `{"t":%Ns,"l":"%Lev","m":"%Msg","p":"%RelFile","f":"%Func"}`,
+		"json":             `{"time":%Ns,"lev":"%Lev","msg":"%Msg"}`,
+		"json-short":       `{"t":%Ns,"l":"%Lev","m":"%Msg"}`,
+
+		"debug":       `[%LEVEL] %RelFile:%Func.%Line %Date %Time %Msg%n`,
+		"debug-short": `[%LEVEL] %Date %Time %Msg%n`,
+		"fast":        `%Ns %l %Msg%n`,
+	}
+
+	predefinedFormats = make(map[string]*formatter)
+
+	for formatKey, format := range predefinedFormatsWithoutPrefix {
+		formatter, err := NewFormatter(format)
+		if err != nil {
+			return err
+		}
+
+		predefinedFormats[predefinedPrefix+formatKey] = formatter
+	}
+
+	return nil
+}
+
+// configFromXMLDecoder parses data from a given XML decoder.
+// Returns parsed config which can be used to create logger in case no errors occured.
+// Returns error if format is incorrect or anything happened.
+func configFromXMLDecoder(xmlParser *xml.Decoder, rootNode xml.Token) (*configForParsing, error) {
+	return configFromXMLDecoderWithConfig(xmlParser, rootNode, nil)
+}
+
+// configFromXMLDecoderWithConfig parses data from a given XML decoder.
+// Returns parsed config which can be used to create logger in case no errors occured.
+// Returns error if format is incorrect or anything happened.
+func configFromXMLDecoderWithConfig(xmlParser *xml.Decoder, rootNode xml.Token, cfg *CfgParseParams) (*configForParsing, error) {
+	_, ok := rootNode.(xml.StartElement)
+	if !ok {
+		return nil, errors.New("rootNode must be XML startElement")
+	}
+
+	config, err := unmarshalNode(xmlParser, rootNode)
+	if err != nil {
+		return nil, err
+	}
+	if config == nil {
+		return nil, errors.New("xml has no content")
+	}
+
+	return configFromXMLNodeWithConfig(config, cfg)
+}
+
+// configFromReader parses data from a given reader.
+// Returns parsed config which can be used to create logger in case no errors occured.
+// Returns error if format is incorrect or anything happened.
+func configFromReader(reader io.Reader) (*configForParsing, error) {
+	return configFromReaderWithConfig(reader, nil)
+}
+
+// configFromReaderWithConfig parses data from a given reader.
+// Returns parsed config which can be used to create logger in case no errors occured.
+// Returns error if format is incorrect or anything happened.
+func configFromReaderWithConfig(reader io.Reader, cfg *CfgParseParams) (*configForParsing, error) {
+	config, err := unmarshalConfig(reader)
+	if err != nil {
+		return nil, err
+	}
+
+	if config.name != seelogConfigID {
+		return nil, errors.New("root xml tag must be '" + seelogConfigID + "'")
+	}
+
+	return configFromXMLNodeWithConfig(config, cfg)
+}
+
+func configFromXMLNodeWithConfig(config *xmlNode, cfg *CfgParseParams) (*configForParsing, error) {
+	err := checkUnexpectedAttribute(
+		config,
+		minLevelID,
+		maxLevelID,
+		levelsID,
+		loggerTypeFromStringAttr,
+		asyncLoggerIntervalAttr,
+		adaptLoggerMinIntervalAttr,
+		adaptLoggerMaxIntervalAttr,
+		adaptLoggerCriticalMsgCountAttr,
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	err = checkExpectedElements(config, optionalElement(outputsID), optionalElement(formatsID), optionalElement(exceptionsID))
+	if err != nil {
+		return nil, err
+	}
+
+	constraints, err := getConstraints(config)
+	if err != nil {
+		return nil, err
+	}
+
+	exceptions, err := getExceptions(config)
+	if err != nil {
+		return nil, err
+	}
+	err = checkDistinctExceptions(exceptions)
+	if err != nil {
+		return nil, err
+	}
+
+	formats, err := getFormats(config)
+	if err != nil {
+		return nil, err
+	}
+
+	dispatcher, err := getOutputsTree(config, formats, cfg)
+	if err != nil {
+		// If we open several files, but then fail to parse the config, we should close
+		// those files before reporting that config is invalid.
+		if dispatcher != nil {
+			dispatcher.Close()
+		}
+
+		return nil, err
+	}
+
+	loggerType, logData, err := getloggerTypeFromStringData(config)
+	if err != nil {
+		return nil, err
+	}
+
+	return newFullLoggerConfig(constraints, exceptions, dispatcher, loggerType, logData, cfg)
+}
+
+func getConstraints(node *xmlNode) (logLevelConstraints, error) {
+	minLevelStr, isMinLevel := node.attributes[minLevelID]
+	maxLevelStr, isMaxLevel := node.attributes[maxLevelID]
+	levelsStr, isLevels := node.attributes[levelsID]
+
+	if isLevels && (isMinLevel && isMaxLevel) {
+		return nil, errors.New("for level declaration use '" + levelsID + "'' OR '" + minLevelID +
+			"', '" + maxLevelID + "'")
+	}
+
+	offString := LogLevel(Off).String()
+
+	if (isLevels && strings.TrimSpace(levelsStr) == offString) ||
+		(isMinLevel && !isMaxLevel && minLevelStr == offString) {
+
+		return NewOffConstraints()
+	}
+
+	if isLevels {
+		levels, err := parseLevels(levelsStr)
+		if err != nil {
+			return nil, err
+		}
+		return NewListConstraints(levels)
+	}
+
+	var minLevel = LogLevel(TraceLvl)
+	if isMinLevel {
+		found := true
+		minLevel, found = LogLevelFromString(minLevelStr)
+		if !found {
+			return nil, errors.New("declared " + minLevelID + " not found: " + minLevelStr)
+		}
+	}
+
+	var maxLevel = LogLevel(CriticalLvl)
+	if isMaxLevel {
+		found := true
+		maxLevel, found = LogLevelFromString(maxLevelStr)
+		if !found {
+			return nil, errors.New("declared " + maxLevelID + " not found: " + maxLevelStr)
+		}
+	}
+
+	return NewMinMaxConstraints(minLevel, maxLevel)
+}
+
+func parseLevels(str string) ([]LogLevel, error) {
+	levelsStrArr := strings.Split(strings.Replace(str, " ", "", -1), ",")
+	var levels []LogLevel
+	for _, levelStr := range levelsStrArr {
+		level, found := LogLevelFromString(levelStr)
+		if !found {
+			return nil, errors.New("declared level not found: " + levelStr)
+		}
+
+		levels = append(levels, level)
+	}
+
+	return levels, nil
+}
+
+func getExceptions(config *xmlNode) ([]*LogLevelException, error) {
+	var exceptions []*LogLevelException
+
+	var exceptionsNode *xmlNode
+	for _, child := range config.children {
+		if child.name == exceptionsID {
+			exceptionsNode = child
+			break
+		}
+	}
+
+	if exceptionsNode == nil {
+		return exceptions, nil
+	}
+
+	err := checkUnexpectedAttribute(exceptionsNode)
+	if err != nil {
+		return nil, err
+	}
+
+	err = checkExpectedElements(exceptionsNode, multipleMandatoryElements("exception"))
+	if err != nil {
+		return nil, err
+	}
+
+	for _, exceptionNode := range exceptionsNode.children {
+		if exceptionNode.name != exceptionID {
+			return nil, errors.New("incorrect nested element in exceptions section: " + exceptionNode.name)
+		}
+
+		err := checkUnexpectedAttribute(exceptionNode, minLevelID, maxLevelID, levelsID, funcPatternID, filePatternID)
+		if err != nil {
+			return nil, err
+		}
+
+		constraints, err := getConstraints(exceptionNode)
+		if err != nil {
+			return nil, errors.New("incorrect " + exceptionsID + " node: " + err.Error())
+		}
+
+		funcPattern, isFuncPattern := exceptionNode.attributes[funcPatternID]
+		filePattern, isFilePattern := exceptionNode.attributes[filePatternID]
+		if !isFuncPattern {
+			funcPattern = "*"
+		}
+		if !isFilePattern {
+			filePattern = "*"
+		}
+
+		exception, err := NewLogLevelException(funcPattern, filePattern, constraints)
+		if err != nil {
+			return nil, errors.New("incorrect exception node: " + err.Error())
+		}
+
+		exceptions = append(exceptions, exception)
+	}
+
+	return exceptions, nil
+}
+
+func checkDistinctExceptions(exceptions []*LogLevelException) error {
+	for i, exception := range exceptions {
+		for j, exception1 := range exceptions {
+			if i == j {
+				continue
+			}
+
+			if exception.FuncPattern() == exception1.FuncPattern() &&
+				exception.FilePattern() == exception1.FilePattern() {
+
+				return fmt.Errorf("there are two or more duplicate exceptions. Func: %v, file %v",
+					exception.FuncPattern(), exception.FilePattern())
+			}
+		}
+	}
+
+	return nil
+}
+
+func getFormats(config *xmlNode) (map[string]*formatter, error) {
+	formats := make(map[string]*formatter, 0)
+
+	var formatsNode *xmlNode
+	for _, child := range config.children {
+		if child.name == formatsID {
+			formatsNode = child
+			break
+		}
+	}
+
+	if formatsNode == nil {
+		return formats, nil
+	}
+
+	err := checkUnexpectedAttribute(formatsNode)
+	if err != nil {
+		return nil, err
+	}
+
+	err = checkExpectedElements(formatsNode, multipleMandatoryElements("format"))
+	if err != nil {
+		return nil, err
+	}
+
+	for _, formatNode := range formatsNode.children {
+		if formatNode.name != formatID {
+			return nil, errors.New("incorrect nested element in " + formatsID + " section: " + formatNode.name)
+		}
+
+		err := checkUnexpectedAttribute(formatNode, formatKeyAttrID, formatID)
+		if err != nil {
+			return nil, err
+		}
+
+		id, isID := formatNode.attributes[formatKeyAttrID]
+		formatStr, isFormat := formatNode.attributes[formatAttrID]
+		if !isID {
+			return nil, errors.New("format has no '" + formatKeyAttrID + "' attribute")
+		}
+		if !isFormat {
+			return nil, errors.New("format[" + id + "] has no '" + formatAttrID + "' attribute")
+		}
+
+		formatter, err := NewFormatter(formatStr)
+		if err != nil {
+			return nil, err
+		}
+
+		formats[id] = formatter
+	}
+
+	return formats, nil
+}
+
+func getloggerTypeFromStringData(config *xmlNode) (logType loggerTypeFromString, logData interface{}, err error) {
+	logTypeStr, loggerTypeExists := config.attributes[loggerTypeFromStringAttr]
+
+	if !loggerTypeExists {
+		return defaultloggerTypeFromString, nil, nil
+	}
+
+	logType, found := getLoggerTypeFromString(logTypeStr)
+
+	if !found {
+		return 0, nil, fmt.Errorf("unknown logger type: %s", logTypeStr)
+	}
+
+	if logType == asyncTimerloggerTypeFromString {
+		intervalStr, intervalExists := config.attributes[asyncLoggerIntervalAttr]
+		if !intervalExists {
+			return 0, nil, newMissingArgumentError(config.name, asyncLoggerIntervalAttr)
+		}
+
+		interval, err := strconv.ParseUint(intervalStr, 10, 32)
+		if err != nil {
+			return 0, nil, err
+		}
+
+		logData = asyncTimerLoggerData{uint32(interval)}
+	} else if logType == adaptiveLoggerTypeFromString {
+
+		// Min interval
+		minIntStr, minIntExists := config.attributes[adaptLoggerMinIntervalAttr]
+		if !minIntExists {
+			return 0, nil, newMissingArgumentError(config.name, adaptLoggerMinIntervalAttr)
+		}
+		minInterval, err := strconv.ParseUint(minIntStr, 10, 32)
+		if err != nil {
+			return 0, nil, err
+		}
+
+		// Max interval
+		maxIntStr, maxIntExists := config.attributes[adaptLoggerMaxIntervalAttr]
+		if !maxIntExists {
+			return 0, nil, newMissingArgumentError(config.name, adaptLoggerMaxIntervalAttr)
+		}
+		maxInterval, err := strconv.ParseUint(maxIntStr, 10, 32)
+		if err != nil {
+			return 0, nil, err
+		}
+
+		// Critical msg count
+		criticalMsgCountStr, criticalMsgCountExists := config.attributes[adaptLoggerCriticalMsgCountAttr]
+		if !criticalMsgCountExists {
+			return 0, nil, newMissingArgumentError(config.name, adaptLoggerCriticalMsgCountAttr)
+		}
+		criticalMsgCount, err := strconv.ParseUint(criticalMsgCountStr, 10, 32)
+		if err != nil {
+			return 0, nil, err
+		}
+
+		logData = adaptiveLoggerData{uint32(minInterval), uint32(maxInterval), uint32(criticalMsgCount)}
+	}
+
+	return logType, logData, nil
+}
+
+func getOutputsTree(config *xmlNode, formats map[string]*formatter, cfg *CfgParseParams) (dispatcherInterface, error) {
+	var outputsNode *xmlNode
+	for _, child := range config.children {
+		if child.name == outputsID {
+			outputsNode = child
+			break
+		}
+	}
+
+	if outputsNode != nil {
+		err := checkUnexpectedAttribute(outputsNode, outputFormatID)
+		if err != nil {
+			return nil, err
+		}
+
+		formatter, err := getCurrentFormat(outputsNode, DefaultFormatter, formats)
+		if err != nil {
+			return nil, err
+		}
+
+		output, err := createSplitter(outputsNode, formatter, formats, cfg)
+		if err != nil {
+			return nil, err
+		}
+
+		dispatcher, ok := output.(dispatcherInterface)
+		if ok {
+			return dispatcher, nil
+		}
+	}
+
+	console, err := NewConsoleWriter()
+	if err != nil {
+		return nil, err
+	}
+	return NewSplitDispatcher(DefaultFormatter, []interface{}{console})
+}
+
+func getCurrentFormat(node *xmlNode, formatFromParent *formatter, formats map[string]*formatter) (*formatter, error) {
+	formatID, isFormatID := node.attributes[outputFormatID]
+	if !isFormatID {
+		return formatFromParent, nil
+	}
+
+	format, ok := formats[formatID]
+	if ok {
+		return format, nil
+	}
+
+	// Test for predefined format match
+	pdFormat, pdOk := predefinedFormats[formatID]
+
+	if !pdOk {
+		return nil, errors.New("formatid = '" + formatID + "' doesn't exist")
+	}
+
+	return pdFormat, nil
+}
+
+func createInnerReceivers(node *xmlNode, format *formatter, formats map[string]*formatter, cfg *CfgParseParams) ([]interface{}, error) {
+	var outputs []interface{}
+	for _, childNode := range node.children {
+		entry, ok := elementMap[childNode.name]
+		if !ok {
+			return nil, errors.New("unnknown tag '" + childNode.name + "' in outputs section")
+		}
+
+		output, err := entry.constructor(childNode, format, formats, cfg)
+		if err != nil {
+			return nil, err
+		}
+
+		outputs = append(outputs, output)
+	}
+
+	return outputs, nil
+}
+
+func createSplitter(node *xmlNode, formatFromParent *formatter, formats map[string]*formatter, cfg *CfgParseParams) (interface{}, error) {
+	err := checkUnexpectedAttribute(node, outputFormatID)
+	if err != nil {
+		return nil, err
+	}
+
+	if !node.hasChildren() {
+		return nil, errNodeMustHaveChildren
+	}
+
+	currentFormat, err := getCurrentFormat(node, formatFromParent, formats)
+	if err != nil {
+		return nil, err
+	}
+
+	receivers, err := createInnerReceivers(node, currentFormat, formats, cfg)
+	if err != nil {
+		return nil, err
+	}
+
+	return NewSplitDispatcher(currentFormat, receivers)
+}
+
+func createCustomReceiver(node *xmlNode, formatFromParent *formatter, formats map[string]*formatter, cfg *CfgParseParams) (interface{}, error) {
+	dataCustomPrefixes := make(map[string]string)
+	// Expecting only 'formatid', 'name' and 'data-' attrs
+	for attr, attrval := range node.attributes {
+		isExpected := false
+		if attr == outputFormatID ||
+			attr == customNameAttrID {
+			isExpected = true
+		}
+		if strings.HasPrefix(attr, customNameDataAttrPrefix) {
+			dataCustomPrefixes[attr[len(customNameDataAttrPrefix):]] = attrval
+			isExpected = true
+		}
+		if !isExpected {
+			return nil, newUnexpectedAttributeError(node.name, attr)
+		}
+	}
+
+	if node.hasChildren() {
+		return nil, errNodeCannotHaveChildren
+	}
+	customName, hasCustomName := node.attributes[customNameAttrID]
+	if !hasCustomName {
+		return nil, newMissingArgumentError(node.name, customNameAttrID)
+	}
+	currentFormat, err := getCurrentFormat(node, formatFromParent, formats)
+	if err != nil {
+		return nil, err
+	}
+	args := CustomReceiverInitArgs{
+		XmlCustomAttrs: dataCustomPrefixes,
+	}
+
+	if cfg != nil && cfg.CustomReceiverProducers != nil {
+		if prod, ok := cfg.CustomReceiverProducers[customName]; ok {
+			rec, err := prod(args)
+			if err != nil {
+				return nil, err
+			}
+			creceiver, err := NewCustomReceiverDispatcherByValue(currentFormat, rec, customName, args)
+			if err != nil {
+				return nil, err
+			}
+			err = rec.AfterParse(args)
+			if err != nil {
+				return nil, err
+			}
+			return creceiver, nil
+		}
+	}
+
+	return NewCustomReceiverDispatcher(currentFormat, customName, args)
+}
+
+func createFilter(node *xmlNode, formatFromParent *formatter, formats map[string]*formatter, cfg *CfgParseParams) (interface{}, error) {
+	err := checkUnexpectedAttribute(node, outputFormatID, filterLevelsAttrID)
+	if err != nil {
+		return nil, err
+	}
+
+	if !node.hasChildren() {
+		return nil, errNodeMustHaveChildren
+	}
+
+	currentFormat, err := getCurrentFormat(node, formatFromParent, formats)
+	if err != nil {
+		return nil, err
+	}
+
+	levelsStr, isLevels := node.attributes[filterLevelsAttrID]
+	if !isLevels {
+		return nil, newMissingArgumentError(node.name, filterLevelsAttrID)
+	}
+
+	levels, err := parseLevels(levelsStr)
+	if err != nil {
+		return nil, err
+	}
+
+	receivers, err := createInnerReceivers(node, currentFormat, formats, cfg)
+	if err != nil {
+		return nil, err
+	}
+
+	return NewFilterDispatcher(currentFormat, receivers, levels...)
+}
+
+func createfileWriter(node *xmlNode, formatFromParent *formatter, formats map[string]*formatter, cfg *CfgParseParams) (interface{}, error) {
+	err := checkUnexpectedAttribute(node, outputFormatID, pathID)
+	if err != nil {
+		return nil, err
+	}
+
+	if node.hasChildren() {
+		return nil, errNodeCannotHaveChildren
+	}
+
+	currentFormat, err := getCurrentFormat(node, formatFromParent, formats)
+	if err != nil {
+		return nil, err
+	}
+
+	path, isPath := node.attributes[pathID]
+	if !isPath {
+		return nil, newMissingArgumentError(node.name, pathID)
+	}
+
+	fileWriter, err := NewFileWriter(path)
+	if err != nil {
+		return nil, err
+	}
+
+	return NewFormattedWriter(fileWriter, currentFormat)
+}
+
+// Creates new SMTP writer if encountered in the config file.
+func createSMTPWriter(node *xmlNode, formatFromParent *formatter, formats map[string]*formatter, cfg *CfgParseParams) (interface{}, error) {
+	err := checkUnexpectedAttribute(node, outputFormatID, senderaddressID, senderNameID, hostNameID, hostPortID, userNameID, userPassID, subjectID)
+	if err != nil {
+		return nil, err
+	}
+	// Node must have children.
+	if !node.hasChildren() {
+		return nil, errNodeMustHaveChildren
+	}
+	currentFormat, err := getCurrentFormat(node, formatFromParent, formats)
+	if err != nil {
+		return nil, err
+	}
+	senderAddress, ok := node.attributes[senderaddressID]
+	if !ok {
+		return nil, newMissingArgumentError(node.name, senderaddressID)
+	}
+	senderName, ok := node.attributes[senderNameID]
+	if !ok {
+		return nil, newMissingArgumentError(node.name, senderNameID)
+	}
+	// Process child nodes scanning for recipient email addresses and/or CA certificate paths.
+	var recipientAddresses []string
+	var caCertDirPaths []string
+	var mailHeaders []string
+	for _, childNode := range node.children {
+		switch childNode.name {
+		// Extract recipient address from child nodes.
+		case recipientID:
+			address, ok := childNode.attributes[addressID]
+			if !ok {
+				return nil, newMissingArgumentError(childNode.name, addressID)
+			}
+			recipientAddresses = append(recipientAddresses, address)
+		// Extract CA certificate file path from child nodes.
+		case cACertDirpathID:
+			path, ok := childNode.attributes[pathID]
+			if !ok {
+				return nil, newMissingArgumentError(childNode.name, pathID)
+			}
+			caCertDirPaths = append(caCertDirPaths, path)
+
+		// Extract email headers from child nodes.
+		case mailHeaderID:
+			headerName, ok := childNode.attributes[mailHeaderNameID]
+			if !ok {
+				return nil, newMissingArgumentError(childNode.name, mailHeaderNameID)
+			}
+
+			headerValue, ok := childNode.attributes[mailHeaderValueID]
+			if !ok {
+				return nil, newMissingArgumentError(childNode.name, mailHeaderValueID)
+			}
+
+			// Build header line
+			mailHeaders = append(mailHeaders, fmt.Sprintf("%s: %s", headerName, headerValue))
+		default:
+			return nil, newUnexpectedChildElementError(childNode.name)
+		}
+	}
+	hostName, ok := node.attributes[hostNameID]
+	if !ok {
+		return nil, newMissingArgumentError(node.name, hostNameID)
+	}
+
+	hostPort, ok := node.attributes[hostPortID]
+	if !ok {
+		return nil, newMissingArgumentError(node.name, hostPortID)
+	}
+
+	// Check if the string can really be converted into int.
+	if _, err := strconv.Atoi(hostPort); err != nil {
+		return nil, errors.New("invalid host port number")
+	}
+
+	userName, ok := node.attributes[userNameID]
+	if !ok {
+		return nil, newMissingArgumentError(node.name, userNameID)
+	}
+
+	userPass, ok := node.attributes[userPassID]
+	if !ok {
+		return nil, newMissingArgumentError(node.name, userPassID)
+	}
+
+	// subject is optionally set by configuration.
+	// default value is defined by DefaultSubjectPhrase constant in the writers_smtpwriter.go
+	var subjectPhrase = DefaultSubjectPhrase
+
+	subject, ok := node.attributes[subjectID]
+	if ok {
+		subjectPhrase = subject
+	}
+
+	smtpWriter := NewSMTPWriter(
+		senderAddress,
+		senderName,
+		recipientAddresses,
+		hostName,
+		hostPort,
+		userName,
+		userPass,
+		caCertDirPaths,
+		subjectPhrase,
+		mailHeaders,
+	)
+
+	return NewFormattedWriter(smtpWriter, currentFormat)
+}
+
+func createConsoleWriter(node *xmlNode, formatFromParent *formatter, formats map[string]*formatter, cfg *CfgParseParams) (interface{}, error) {
+	err := checkUnexpectedAttribute(node, outputFormatID)
+	if err != nil {
+		return nil, err
+	}
+
+	if node.hasChildren() {
+		return nil, errNodeCannotHaveChildren
+	}
+
+	currentFormat, err := getCurrentFormat(node, formatFromParent, formats)
+	if err != nil {
+		return nil, err
+	}
+
+	consoleWriter, err := NewConsoleWriter()
+	if err != nil {
+		return nil, err
+	}
+
+	return NewFormattedWriter(consoleWriter, currentFormat)
+}
+
+func createconnWriter(node *xmlNode, formatFromParent *formatter, formats map[string]*formatter, cfg *CfgParseParams) (interface{}, error) {
+	if node.hasChildren() {
+		return nil, errNodeCannotHaveChildren
+	}
+
+	err := checkUnexpectedAttribute(node, outputFormatID, connWriterAddrAttr, connWriterNetAttr, connWriterReconnectOnMsgAttr, connWriterUseTLSAttr, connWriterInsecureSkipVerifyAttr)
+	if err != nil {
+		return nil, err
+	}
+
+	currentFormat, err := getCurrentFormat(node, formatFromParent, formats)
+	if err != nil {
+		return nil, err
+	}
+
+	addr, isAddr := node.attributes[connWriterAddrAttr]
+	if !isAddr {
+		return nil, newMissingArgumentError(node.name, connWriterAddrAttr)
+	}
+
+	net, isNet := node.attributes[connWriterNetAttr]
+	if !isNet {
+		return nil, newMissingArgumentError(node.name, connWriterNetAttr)
+	}
+
+	reconnectOnMsg := false
+	reconnectOnMsgStr, isReconnectOnMsgStr := node.attributes[connWriterReconnectOnMsgAttr]
+	if isReconnectOnMsgStr {
+		if reconnectOnMsgStr == "true" {
+			reconnectOnMsg = true
+		} else if reconnectOnMsgStr == "false" {
+			reconnectOnMsg = false
+		} else {
+			return nil, errors.New("node '" + node.name + "' has incorrect '" + connWriterReconnectOnMsgAttr + "' attribute value")
+		}
+	}
+
+	useTLS := false
+	useTLSStr, isUseTLSStr := node.attributes[connWriterUseTLSAttr]
+	if isUseTLSStr {
+		if useTLSStr == "true" {
+			useTLS = true
+		} else if useTLSStr == "false" {
+			useTLS = false
+		} else {
+			return nil, errors.New("node '" + node.name + "' has incorrect '" + connWriterUseTLSAttr + "' attribute value")
+		}
+		if useTLS {
+			insecureSkipVerify := false
+			insecureSkipVerifyStr, isInsecureSkipVerify := node.attributes[connWriterInsecureSkipVerifyAttr]
+			if isInsecureSkipVerify {
+				if insecureSkipVerifyStr == "true" {
+					insecureSkipVerify = true
+				} else if insecureSkipVerifyStr == "false" {
+					insecureSkipVerify = false
+				} else {
+					return nil, errors.New("node '" + node.name + "' has incorrect '" + connWriterInsecureSkipVerifyAttr + "' attribute value")
+				}
+			}
+			config := tls.Config{InsecureSkipVerify: insecureSkipVerify}
+			connWriter := newTLSWriter(net, addr, reconnectOnMsg, &config)
+			return NewFormattedWriter(connWriter, currentFormat)
+		}
+	}
+
+	connWriter := NewConnWriter(net, addr, reconnectOnMsg)
+
+	return NewFormattedWriter(connWriter, currentFormat)
+}
+
+func createRollingFileWriter(node *xmlNode, formatFromParent *formatter, formats map[string]*formatter, cfg *CfgParseParams) (interface{}, error) {
+	if node.hasChildren() {
+		return nil, errNodeCannotHaveChildren
+	}
+
+	rollingTypeStr, isRollingType := node.attributes[rollingFileTypeAttr]
+	if !isRollingType {
+		return nil, newMissingArgumentError(node.name, rollingFileTypeAttr)
+	}
+
+	rollingType, ok := rollingTypeFromString(rollingTypeStr)
+	if !ok {
+		return nil, errors.New("unknown rolling file type: " + rollingTypeStr)
+	}
+
+	currentFormat, err := getCurrentFormat(node, formatFromParent, formats)
+	if err != nil {
+		return nil, err
+	}
+
+	path, isPath := node.attributes[rollingFilePathAttr]
+	if !isPath {
+		return nil, newMissingArgumentError(node.name, rollingFilePathAttr)
+	}
+
+	rollingArchiveStr, archiveAttrExists := node.attributes[rollingFileArchiveAttr]
+
+	var rArchiveType rollingArchiveType
+	var rArchivePath string
+	if !archiveAttrExists {
+		rArchiveType = rollingArchiveNone
+		rArchivePath = ""
+	} else {
+		rArchiveType, ok = rollingArchiveTypeFromString(rollingArchiveStr)
+		if !ok {
+			return nil, errors.New("unknown rolling archive type: " + rollingArchiveStr)
+		}
+
+		if rArchiveType == rollingArchiveNone {
+			rArchivePath = ""
+		} else {
+			rArchivePath, ok = node.attributes[rollingFileArchivePathAttr]
+			if !ok {
+				rArchivePath, ok = rollingArchiveTypesDefaultNames[rArchiveType]
+				if !ok {
+					return nil, fmt.Errorf("cannot get default filename for archive type = %v",
+						rArchiveType)
+				}
+			}
+		}
+	}
+
+	nameMode := rollingNameMode(rollingNameModePostfix)
+	nameModeStr, ok := node.attributes[rollingFileNameModeAttr]
+	if ok {
+		mode, found := rollingNameModeFromString(nameModeStr)
+		if !found {
+			return nil, errors.New("unknown rolling filename mode: " + nameModeStr)
+		} else {
+			nameMode = mode
+		}
+	}
+
+	if rollingType == rollingTypeSize {
+		err := checkUnexpectedAttribute(node, outputFormatID, rollingFileTypeAttr, rollingFilePathAttr,
+			rollingFileMaxSizeAttr, rollingFileMaxRollsAttr, rollingFileArchiveAttr,
+			rollingFileArchivePathAttr, rollingFileNameModeAttr)
+		if err != nil {
+			return nil, err
+		}
+
+		maxSizeStr, ok := node.attributes[rollingFileMaxSizeAttr]
+		if !ok {
+			return nil, newMissingArgumentError(node.name, rollingFileMaxSizeAttr)
+		}
+
+		maxSize, err := strconv.ParseInt(maxSizeStr, 10, 64)
+		if err != nil {
+			return nil, err
+		}
+
+		maxRolls := 0
+		maxRollsStr, ok := node.attributes[rollingFileMaxRollsAttr]
+		if ok {
+			maxRolls, err = strconv.Atoi(maxRollsStr)
+			if err != nil {
+				return nil, err
+			}
+		}
+
+		rollingWriter, err := NewRollingFileWriterSize(path, rArchiveType, rArchivePath, maxSize, maxRolls, nameMode)
+		if err != nil {
+			return nil, err
+		}
+
+		return NewFormattedWriter(rollingWriter, currentFormat)
+
+	} else if rollingType == rollingTypeTime {
+		err := checkUnexpectedAttribute(node, outputFormatID, rollingFileTypeAttr, rollingFilePathAttr,
+			rollingFileDataPatternAttr, rollingFileArchiveAttr, rollingFileMaxRollsAttr,
+			rollingFileArchivePathAttr, rollingFileNameModeAttr)
+		if err != nil {
+			return nil, err
+		}
+
+		maxRolls := 0
+		maxRollsStr, ok := node.attributes[rollingFileMaxRollsAttr]
+		if ok {
+			maxRolls, err = strconv.Atoi(maxRollsStr)
+			if err != nil {
+				return nil, err
+			}
+		}
+
+		dataPattern, ok := node.attributes[rollingFileDataPatternAttr]
+		if !ok {
+			return nil, newMissingArgumentError(node.name, rollingFileDataPatternAttr)
+		}
+
+		rollingWriter, err := NewRollingFileWriterTime(path, rArchiveType, rArchivePath, maxRolls, dataPattern, rollingIntervalAny, nameMode)
+		if err != nil {
+			return nil, err
+		}
+
+		return NewFormattedWriter(rollingWriter, currentFormat)
+	}
+
+	return nil, errors.New("incorrect rolling writer type " + rollingTypeStr)
+}
+
+func createbufferedWriter(node *xmlNode, formatFromParent *formatter, formats map[string]*formatter, cfg *CfgParseParams) (interface{}, error) {
+	err := checkUnexpectedAttribute(node, outputFormatID, bufferedSizeAttr, bufferedFlushPeriodAttr)
+	if err != nil {
+		return nil, err
+	}
+
+	if !node.hasChildren() {
+		return nil, errNodeMustHaveChildren
+	}
+
+	currentFormat, err := getCurrentFormat(node, formatFromParent, formats)
+	if err != nil {
+		return nil, err
+	}
+
+	sizeStr, isSize := node.attributes[bufferedSizeAttr]
+	if !isSize {
+		return nil, newMissingArgumentError(node.name, bufferedSizeAttr)
+	}
+
+	size, err := strconv.Atoi(sizeStr)
+	if err != nil {
+		return nil, err
+	}
+
+	flushPeriod := 0
+	flushPeriodStr, isFlushPeriod := node.attributes[bufferedFlushPeriodAttr]
+	if isFlushPeriod {
+		flushPeriod, err = strconv.Atoi(flushPeriodStr)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	// Inner writer couldn't have its own format, so we pass 'currentFormat' as its parent format
+	receivers, err := createInnerReceivers(node, currentFormat, formats, cfg)
+	if err != nil {
+		return nil, err
+	}
+
+	formattedWriter, ok := receivers[0].(*formattedWriter)
+	if !ok {
+		return nil, errors.New("buffered writer's child is not writer")
+	}
+
+	// ... and then we check that it hasn't changed
+	if formattedWriter.Format() != currentFormat {
+		return nil, errors.New("inner writer cannot have his own format")
+	}
+
+	bufferedWriter, err := NewBufferedWriter(formattedWriter.Writer(), size, time.Duration(flushPeriod))
+	if err != nil {
+		return nil, err
+	}
+
+	return NewFormattedWriter(bufferedWriter, currentFormat)
+}
+
+// Returns an error if node has any attributes not listed in expectedAttrs.
+func checkUnexpectedAttribute(node *xmlNode, expectedAttrs ...string) error {
+	for attr := range node.attributes {
+		isExpected := false
+		for _, expected := range expectedAttrs {
+			if attr == expected {
+				isExpected = true
+				break
+			}
+		}
+		if !isExpected {
+			return newUnexpectedAttributeError(node.name, attr)
+		}
+	}
+
+	return nil
+}
+
+type expectedElementInfo struct {
+	name      string
+	mandatory bool
+	multiple  bool
+}
+
+func optionalElement(name string) expectedElementInfo {
+	return expectedElementInfo{name, false, false}
+}
+func mandatoryElement(name string) expectedElementInfo {
+	return expectedElementInfo{name, true, false}
+}
+func multipleElements(name string) expectedElementInfo {
+	return expectedElementInfo{name, false, true}
+}
+func multipleMandatoryElements(name string) expectedElementInfo {
+	return expectedElementInfo{name, true, true}
+}
+
+func checkExpectedElements(node *xmlNode, elements ...expectedElementInfo) error {
+	for _, element := range elements {
+		count := 0
+		for _, child := range node.children {
+			if child.name == element.name {
+				count++
+			}
+		}
+
+		if count == 0 && element.mandatory {
+			return errors.New(node.name + " does not have mandatory subnode - " + element.name)
+		}
+		if count > 1 && !element.multiple {
+			return errors.New(node.name + " has more then one subnode - " + element.name)
+		}
+	}
+
+	for _, child := range node.children {
+		isExpected := false
+		for _, element := range elements {
+			if child.name == element.name {
+				isExpected = true
+			}
+		}
+
+		if !isExpected {
+			return errors.New(node.name + " has unexpected child: " + child.name)
+		}
+	}
+
+	return nil
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/common_closer.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/common_closer.go
new file mode 100644
index 00000000..1319c221
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/common_closer.go
@@ -0,0 +1,25 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/common_constraints.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/common_constraints.go
new file mode 100644
index 00000000..7ec2fe5b
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/common_constraints.go
@@ -0,0 +1,162 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+)
+
+// Represents constraints which form a general rule for log levels selection
+type logLevelConstraints interface {
+	IsAllowed(level LogLevel) bool
+}
+
+// A minMaxConstraints represents constraints which use minimal and maximal allowed log levels.
+type minMaxConstraints struct {
+	min LogLevel
+	max LogLevel
+}
+
+// NewMinMaxConstraints creates a new minMaxConstraints struct with the specified min and max levels.
+func NewMinMaxConstraints(min LogLevel, max LogLevel) (*minMaxConstraints, error) {
+	if min > max {
+		return nil, fmt.Errorf("min level can't be greater than max. Got min: %d, max: %d", min, max)
+	}
+	if min < TraceLvl || min > CriticalLvl {
+		return nil, fmt.Errorf("min level can't be less than Trace or greater than Critical. Got min: %d", min)
+	}
+	if max < TraceLvl || max > CriticalLvl {
+		return nil, fmt.Errorf("max level can't be less than Trace or greater than Critical. Got max: %d", max)
+	}
+
+	return &minMaxConstraints{min, max}, nil
+}
+
+// IsAllowed returns true, if log level is in [min, max] range (inclusive).
+func (minMaxConstr *minMaxConstraints) IsAllowed(level LogLevel) bool {
+	return level >= minMaxConstr.min && level <= minMaxConstr.max
+}
+
+func (minMaxConstr *minMaxConstraints) String() string {
+	return fmt.Sprintf("Min: %s. Max: %s", minMaxConstr.min, minMaxConstr.max)
+}
+
+//=======================================================
+
+// A listConstraints represents constraints which use allowed log levels list.
+type listConstraints struct {
+	allowedLevels map[LogLevel]bool
+}
+
+// NewListConstraints creates a new listConstraints struct with the specified allowed levels.
+func NewListConstraints(allowList []LogLevel) (*listConstraints, error) {
+	if allowList == nil {
+		return nil, errors.New("list can't be nil")
+	}
+
+	allowLevels, err := createMapFromList(allowList)
+	if err != nil {
+		return nil, err
+	}
+	err = validateOffLevel(allowLevels)
+	if err != nil {
+		return nil, err
+	}
+
+	return &listConstraints{allowLevels}, nil
+}
+
+func (listConstr *listConstraints) String() string {
+	allowedList := "List: "
+
+	listLevel := make([]string, len(listConstr.allowedLevels))
+
+	var logLevel LogLevel
+	i := 0
+	for logLevel = TraceLvl; logLevel <= Off; logLevel++ {
+		if listConstr.allowedLevels[logLevel] {
+			listLevel[i] = logLevel.String()
+			i++
+		}
+	}
+
+	allowedList += strings.Join(listLevel, ",")
+
+	return allowedList
+}
+
+func createMapFromList(allowedList []LogLevel) (map[LogLevel]bool, error) {
+	allowedLevels := make(map[LogLevel]bool, 0)
+	for _, level := range allowedList {
+		if level < TraceLvl || level > Off {
+			return nil, fmt.Errorf("level can't be less than Trace or greater than Critical. Got level: %d", level)
+		}
+		allowedLevels[level] = true
+	}
+	return allowedLevels, nil
+}
+func validateOffLevel(allowedLevels map[LogLevel]bool) error {
+	if _, ok := allowedLevels[Off]; ok && len(allowedLevels) > 1 {
+		return errors.New("logLevel Off cant be mixed with other levels")
+	}
+
+	return nil
+}
+
+// IsAllowed returns true, if log level is in allowed log levels list.
+// If the list contains the only item 'common.Off' then IsAllowed will always return false for any input values.
+func (listConstr *listConstraints) IsAllowed(level LogLevel) bool {
+	for l := range listConstr.allowedLevels {
+		if l == level && level != Off {
+			return true
+		}
+	}
+
+	return false
+}
+
+// AllowedLevels returns allowed levels configuration as a map.
+func (listConstr *listConstraints) AllowedLevels() map[LogLevel]bool {
+	return listConstr.allowedLevels
+}
+
+//=======================================================
+
+type offConstraints struct {
+}
+
+func NewOffConstraints() (*offConstraints, error) {
+	return &offConstraints{}, nil
+}
+
+func (offConstr *offConstraints) IsAllowed(level LogLevel) bool {
+	return false
+}
+
+func (offConstr *offConstraints) String() string {
+	return "Off constraint"
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/common_context.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/common_context.go
new file mode 100644
index 00000000..04bc2235
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/common_context.go
@@ -0,0 +1,194 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"time"
+)
+
+var workingDir = "/"
+
+func init() {
+	wd, err := os.Getwd()
+	if err == nil {
+		workingDir = filepath.ToSlash(wd) + "/"
+	}
+}
+
+// Represents runtime caller context.
+type LogContextInterface interface {
+	// Caller's function name.
+	Func() string
+	// Caller's line number.
+	Line() int
+	// Caller's file short path (in slashed form).
+	ShortPath() string
+	// Caller's file full path (in slashed form).
+	FullPath() string
+	// Caller's file name (without path).
+	FileName() string
+	// True if the context is correct and may be used.
+	// If false, then an error in context evaluation occurred and
+	// all its other data may be corrupted.
+	IsValid() bool
+	// Time when log function was called.
+	CallTime() time.Time
+	// Custom context that can be set by calling logger.SetContext
+	CustomContext() interface{}
+}
+
+// Returns context of the caller
+func currentContext(custom interface{}) (LogContextInterface, error) {
+	return specifyContext(1, custom)
+}
+
+func extractCallerInfo(skip int) (fullPath string, shortPath string, funcName string, line int, err error) {
+	pc, fp, ln, ok := runtime.Caller(skip)
+	if !ok {
+		err = fmt.Errorf("error during runtime.Caller")
+		return
+	}
+	line = ln
+	fullPath = fp
+	if strings.HasPrefix(fp, workingDir) {
+		shortPath = fp[len(workingDir):]
+	} else {
+		shortPath = fp
+	}
+	funcName = runtime.FuncForPC(pc).Name()
+	if strings.HasPrefix(funcName, workingDir) {
+		funcName = funcName[len(workingDir):]
+	}
+	return
+}
+
+// Returns context of the function with placed "skip" stack frames of the caller
+// If skip == 0 then behaves like currentContext
+// Context is returned in any situation, even if error occurs. But, if an error
+// occurs, the returned context is an error context, which contains no paths
+// or names, but states that they can't be extracted.
+func specifyContext(skip int, custom interface{}) (LogContextInterface, error) {
+	callTime := time.Now()
+	if skip < 0 {
+		err := fmt.Errorf("can not skip negative stack frames")
+		return &errorContext{callTime, err}, err
+	}
+	fullPath, shortPath, funcName, line, err := extractCallerInfo(skip + 2)
+	if err != nil {
+		return &errorContext{callTime, err}, err
+	}
+	_, fileName := filepath.Split(fullPath)
+	return &logContext{funcName, line, shortPath, fullPath, fileName, callTime, custom}, nil
+}
+
+// Represents a normal runtime caller context.
+type logContext struct {
+	funcName  string
+	line      int
+	shortPath string
+	fullPath  string
+	fileName  string
+	callTime  time.Time
+	custom    interface{}
+}
+
+func (context *logContext) IsValid() bool {
+	return true
+}
+
+func (context *logContext) Func() string {
+	return context.funcName
+}
+
+func (context *logContext) Line() int {
+	return context.line
+}
+
+func (context *logContext) ShortPath() string {
+	return context.shortPath
+}
+
+func (context *logContext) FullPath() string {
+	return context.fullPath
+}
+
+func (context *logContext) FileName() string {
+	return context.fileName
+}
+
+func (context *logContext) CallTime() time.Time {
+	return context.callTime
+}
+
+func (context *logContext) CustomContext() interface{} {
+	return context.custom
+}
+
+// Represents an error context
+type errorContext struct {
+	errorTime time.Time
+	err       error
+}
+
+func (errContext *errorContext) getErrorText(prefix string) string {
+	return fmt.Sprintf("%s() error: %s", prefix, errContext.err)
+}
+
+func (errContext *errorContext) IsValid() bool {
+	return false
+}
+
+func (errContext *errorContext) Line() int {
+	return -1
+}
+
+func (errContext *errorContext) Func() string {
+	return errContext.getErrorText("Func")
+}
+
+func (errContext *errorContext) ShortPath() string {
+	return errContext.getErrorText("ShortPath")
+}
+
+func (errContext *errorContext) FullPath() string {
+	return errContext.getErrorText("FullPath")
+}
+
+func (errContext *errorContext) FileName() string {
+	return errContext.getErrorText("FileName")
+}
+
+func (errContext *errorContext) CallTime() time.Time {
+	return errContext.errorTime
+}
+
+func (errContext *errorContext) CustomContext() interface{} {
+	return nil
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/common_exception.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/common_exception.go
new file mode 100644
index 00000000..9acc2750
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/common_exception.go
@@ -0,0 +1,194 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"errors"
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+// Used in rules creation to validate input file and func filters
+var (
+	fileFormatValidator = regexp.MustCompile(`[a-zA-Z0-9\\/ _\*\.]*`)
+	funcFormatValidator = regexp.MustCompile(`[a-zA-Z0-9_\*\.]*`)
+)
+
+// LogLevelException represents an exceptional case used when you need some specific files or funcs to
+// override general constraints and to use their own.
+type LogLevelException struct {
+	funcPatternParts []string
+	filePatternParts []string
+
+	funcPattern string
+	filePattern string
+
+	constraints logLevelConstraints
+}
+
+// NewLogLevelException creates a new exception.
+func NewLogLevelException(funcPattern string, filePattern string, constraints logLevelConstraints) (*LogLevelException, error) {
+	if constraints == nil {
+		return nil, errors.New("constraints can not be nil")
+	}
+
+	exception := new(LogLevelException)
+
+	err := exception.initFuncPatternParts(funcPattern)
+	if err != nil {
+		return nil, err
+	}
+	exception.funcPattern = strings.Join(exception.funcPatternParts, "")
+
+	err = exception.initFilePatternParts(filePattern)
+	if err != nil {
+		return nil, err
+	}
+	exception.filePattern = strings.Join(exception.filePatternParts, "")
+
+	exception.constraints = constraints
+
+	return exception, nil
+}
+
+// MatchesContext returns true if context matches the patterns of this LogLevelException
+func (logLevelEx *LogLevelException) MatchesContext(context LogContextInterface) bool {
+	return logLevelEx.match(context.Func(), context.FullPath())
+}
+
+// IsAllowed returns true if log level is allowed according to the constraints of this LogLevelException
+func (logLevelEx *LogLevelException) IsAllowed(level LogLevel) bool {
+	return logLevelEx.constraints.IsAllowed(level)
+}
+
+// FuncPattern returns the function pattern of a exception
+func (logLevelEx *LogLevelException) FuncPattern() string {
+	return logLevelEx.funcPattern
+}
+
+// FuncPattern returns the file pattern of a exception
+func (logLevelEx *LogLevelException) FilePattern() string {
+	return logLevelEx.filePattern
+}
+
+// initFuncPatternParts checks whether the func filter has a correct format and splits funcPattern on parts
+func (logLevelEx *LogLevelException) initFuncPatternParts(funcPattern string) (err error) {
+
+	if funcFormatValidator.FindString(funcPattern) != funcPattern {
+		return errors.New("func path \"" + funcPattern + "\" contains incorrect symbols. Only a-z A-Z 0-9 _ * . allowed)")
+	}
+
+	logLevelEx.funcPatternParts = splitPattern(funcPattern)
+	return nil
+}
+
+// Checks whether the file filter has a correct format and splits file patterns using splitPattern.
+func (logLevelEx *LogLevelException) initFilePatternParts(filePattern string) (err error) {
+
+	if fileFormatValidator.FindString(filePattern) != filePattern {
+		return errors.New("file path \"" + filePattern + "\" contains incorrect symbols. Only a-z A-Z 0-9 \\ / _ * . allowed)")
+	}
+
+	logLevelEx.filePatternParts = splitPattern(filePattern)
+	return err
+}
+
+func (logLevelEx *LogLevelException) match(funcPath string, filePath string) bool {
+	if !stringMatchesPattern(logLevelEx.funcPatternParts, funcPath) {
+		return false
+	}
+	return stringMatchesPattern(logLevelEx.filePatternParts, filePath)
+}
+
+func (logLevelEx *LogLevelException) String() string {
+	str := fmt.Sprintf("Func: %s File: %s", logLevelEx.funcPattern, logLevelEx.filePattern)
+
+	if logLevelEx.constraints != nil {
+		str += fmt.Sprintf("Constr: %s", logLevelEx.constraints)
+	} else {
+		str += "nil"
+	}
+
+	return str
+}
+
+// splitPattern splits pattern into strings and asterisks. Example: "ab*cde**f" -> ["ab", "*", "cde", "*", "f"]
+func splitPattern(pattern string) []string {
+	var patternParts []string
+	var lastChar rune
+	for _, char := range pattern {
+		if char == '*' {
+			if lastChar != '*' {
+				patternParts = append(patternParts, "*")
+			}
+		} else {
+			if len(patternParts) != 0 && lastChar != '*' {
+				patternParts[len(patternParts)-1] += string(char)
+			} else {
+				patternParts = append(patternParts, string(char))
+			}
+		}
+		lastChar = char
+	}
+
+	return patternParts
+}
+
+// stringMatchesPattern check whether testString matches pattern with asterisks.
+// Standard regexp functionality is not used here because of performance issues.
+func stringMatchesPattern(patternparts []string, testString string) bool {
+	if len(patternparts) == 0 {
+		return len(testString) == 0
+	}
+
+	part := patternparts[0]
+	if part != "*" {
+		index := strings.Index(testString, part)
+		if index == 0 {
+			return stringMatchesPattern(patternparts[1:], testString[len(part):])
+		}
+	} else {
+		if len(patternparts) == 1 {
+			return true
+		}
+
+		newTestString := testString
+		part = patternparts[1]
+		for {
+			index := strings.Index(newTestString, part)
+			if index == -1 {
+				break
+			}
+
+			newTestString = newTestString[index+len(part):]
+			result := stringMatchesPattern(patternparts[2:], newTestString)
+			if result {
+				return true
+			}
+		}
+	}
+	return false
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/common_flusher.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/common_flusher.go
new file mode 100644
index 00000000..0ef077c8
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/common_flusher.go
@@ -0,0 +1,31 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+// flusherInterface represents all objects that have to do cleanup
+// at certain moments of time (e.g. before app shutdown to avoid data loss)
+type flusherInterface interface {
+	Flush()
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/common_loglevel.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/common_loglevel.go
new file mode 100644
index 00000000..d54ecf27
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/common_loglevel.go
@@ -0,0 +1,81 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+// Log level type
+type LogLevel uint8
+
+// Log levels
+const (
+	TraceLvl = iota
+	DebugLvl
+	InfoLvl
+	WarnLvl
+	ErrorLvl
+	CriticalLvl
+	Off
+)
+
+// Log level string representations (used in configuration files)
+const (
+	TraceStr    = "trace"
+	DebugStr    = "debug"
+	InfoStr     = "info"
+	WarnStr     = "warn"
+	ErrorStr    = "error"
+	CriticalStr = "critical"
+	OffStr      = "off"
+)
+
+var levelToStringRepresentations = map[LogLevel]string{
+	TraceLvl:    TraceStr,
+	DebugLvl:    DebugStr,
+	InfoLvl:     InfoStr,
+	WarnLvl:     WarnStr,
+	ErrorLvl:    ErrorStr,
+	CriticalLvl: CriticalStr,
+	Off:         OffStr,
+}
+
+// LogLevelFromString parses a string and returns a corresponding log level, if sucessfull.
+func LogLevelFromString(levelStr string) (level LogLevel, found bool) {
+	for lvl, lvlStr := range levelToStringRepresentations {
+		if lvlStr == levelStr {
+			return lvl, true
+		}
+	}
+
+	return 0, false
+}
+
+// LogLevelToString returns seelog string representation for a specified level. Returns "" for invalid log levels.
+func (level LogLevel) String() string {
+	levelStr, ok := levelToStringRepresentations[level]
+	if ok {
+		return levelStr
+	}
+
+	return ""
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/dispatch_custom.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/dispatch_custom.go
new file mode 100644
index 00000000..383a7705
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/dispatch_custom.go
@@ -0,0 +1,242 @@
+// Copyright (c) 2013 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"errors"
+	"fmt"
+	"reflect"
+	"sort"
+)
+
+var registeredReceivers = make(map[string]reflect.Type)
+
+// RegisterReceiver records a custom receiver type, identified by a value
+// of that type (second argument), under the specified name. Registered
+// names can be used in the "name" attribute of <custom> config items.
+//
+// RegisterReceiver takes the type of the receiver argument, without taking
+// the value into the account. So do NOT enter any data to the second argument
+// and only call it like:
+//     RegisterReceiver("somename", &MyReceiverType{})
+//
+// After that, when a '<custom>' config tag with this name is used,
+// a receiver of the specified type would be instantiated. Check
+// CustomReceiver comments for interface details.
+//
+// NOTE 1: RegisterReceiver fails if you attempt to register different types
+// with the same name.
+//
+// NOTE 2: RegisterReceiver registers those receivers that must be used in
+// the configuration files (<custom> items). Basically it is just the way
+// you tell seelog config parser what should it do when it meets a
+// <custom> tag with a specific name and data attributes.
+//
+// But If you are only using seelog as a proxy to an already instantiated
+// CustomReceiver (via LoggerFromCustomReceiver func), you should not call RegisterReceiver.
+func RegisterReceiver(name string, receiver CustomReceiver) {
+	newType := reflect.TypeOf(reflect.ValueOf(receiver).Elem().Interface())
+	if t, ok := registeredReceivers[name]; ok && t != newType {
+		panic(fmt.Sprintf("duplicate types for %s: %s != %s", name, t, newType))
+	}
+	registeredReceivers[name] = newType
+}
+
+func customReceiverByName(name string) (creceiver CustomReceiver, err error) {
+	rt, ok := registeredReceivers[name]
+	if !ok {
+		return nil, fmt.Errorf("custom receiver name not registered: '%s'", name)
+	}
+	v, ok := reflect.New(rt).Interface().(CustomReceiver)
+	if !ok {
+		return nil, fmt.Errorf("cannot instantiate receiver with name='%s'", name)
+	}
+	return v, nil
+}
+
+// CustomReceiverInitArgs represent arguments passed to the CustomReceiver.Init
+// func when custom receiver is being initialized.
+type CustomReceiverInitArgs struct {
+	// XmlCustomAttrs represent '<custom>' xml config item attributes that
+	// start with "data-". Map keys will be the attribute names without the "data-".
+	// Map values will the those attribute values.
+	//
+	// E.g. if you have a '<custom name="somename" data-attr1="a1" data-attr2="a2"/>'
+	// you will get map with 2 key-value pairs: "attr1"->"a1", "attr2"->"a2"
+	//
+	// Note that in custom items you can only use allowed attributes, like "name" and
+	// your custom attributes, starting with "data-". Any other will lead to a
+	// parsing error.
+	XmlCustomAttrs map[string]string
+}
+
+// CustomReceiver is the interface that external custom seelog message receivers
+// must implement in order to be able to process seelog messages. Those receivers
+// are set in the xml config file using the <custom> tag. Check receivers reference
+// wiki section on that.
+//
+// Use seelog.RegisterReceiver on the receiver type before using it.
+type CustomReceiver interface {
+	// ReceiveMessage is called when the custom receiver gets seelog message from
+	// a parent dispatcher.
+	//
+	// Message, level and context args represent all data that was included in the seelog
+	// message at the time it was logged.
+	//
+	// The formatting is already applied to the message and depends on the config
+	// like with any other receiver.
+	//
+	// If you would like to inform seelog of an error that happened during the handling of
+	// the message, return a non-nil error. This way you'll end up seeing your error like
+	// any other internal seelog error.
+	ReceiveMessage(message string, level LogLevel, context LogContextInterface) error
+
+	// AfterParse is called immediately after your custom receiver is instantiated by
+	// the xml config parser. So, if you need to do any startup logic after config parsing,
+	// like opening file or allocating any resources after the receiver is instantiated, do it here.
+	//
+	// If this func returns a non-nil error, then the loading procedure will fail. E.g.
+	// if you are loading a seelog xml config, the parser would not finish the loading
+	// procedure and inform about an error like with any other config error.
+	//
+	// If your custom logger needs some configuration, you can use custom attributes in
+	// your config. Check CustomReceiverInitArgs.XmlCustomAttrs comments.
+	//
+	// IMPORTANT: This func is NOT called when the LoggerFromCustomReceiver func is used
+	// to create seelog proxy logger using the custom receiver. This func is only called when
+	// receiver is instantiated from a config.
+	AfterParse(initArgs CustomReceiverInitArgs) error
+
+	// Flush is called when the custom receiver gets a 'flush' directive from a
+	// parent receiver. If custom receiver implements some kind of buffering or
+	// queing, then the appropriate reaction on a flush message is synchronous
+	// flushing of all those queues/buffers. If custom receiver doesn't have
+	// such mechanisms, then flush implementation may be left empty.
+	Flush()
+
+	// Close is called when the custom receiver gets a 'close' directive from a
+	// parent receiver. This happens when a top-level seelog dispatcher is sending
+	// 'close' to all child nodes and it means that current seelog logger is being closed.
+	// If you need to do any cleanup after your custom receiver is done, you should do
+	// it here.
+	Close() error
+}
+
+type customReceiverDispatcher struct {
+	formatter          *formatter
+	innerReceiver      CustomReceiver
+	customReceiverName string
+	usedArgs           CustomReceiverInitArgs
+}
+
+// NewCustomReceiverDispatcher creates a customReceiverDispatcher which dispatches data to a specific receiver created
+// using a <custom> tag in the config file.
+func NewCustomReceiverDispatcher(formatter *formatter, customReceiverName string, cArgs CustomReceiverInitArgs) (*customReceiverDispatcher, error) {
+	if formatter == nil {
+		return nil, errors.New("formatter cannot be nil")
+	}
+	if len(customReceiverName) == 0 {
+		return nil, errors.New("custom receiver name cannot be empty")
+	}
+
+	creceiver, err := customReceiverByName(customReceiverName)
+	if err != nil {
+		return nil, err
+	}
+	err = creceiver.AfterParse(cArgs)
+	if err != nil {
+		return nil, err
+	}
+	disp := &customReceiverDispatcher{formatter, creceiver, customReceiverName, cArgs}
+
+	return disp, nil
+}
+
+// NewCustomReceiverDispatcherByValue is basically the same as NewCustomReceiverDispatcher, but using
+// a specific CustomReceiver value instead of instantiating a new one by type.
+func NewCustomReceiverDispatcherByValue(formatter *formatter, customReceiver CustomReceiver, name string, cArgs CustomReceiverInitArgs) (*customReceiverDispatcher, error) {
+	if formatter == nil {
+		return nil, errors.New("formatter cannot be nil")
+	}
+	if customReceiver == nil {
+		return nil, errors.New("customReceiver cannot be nil")
+	}
+	disp := &customReceiverDispatcher{formatter, customReceiver, name, cArgs}
+
+	return disp, nil
+}
+
+// CustomReceiver implementation. Check CustomReceiver comments.
+func (disp *customReceiverDispatcher) Dispatch(
+	message string,
+	level LogLevel,
+	context LogContextInterface,
+	errorFunc func(err error)) {
+
+	defer func() {
+		if err := recover(); err != nil {
+			errorFunc(fmt.Errorf("panic in custom receiver '%s'.Dispatch: %s", reflect.TypeOf(disp.innerReceiver), err))
+		}
+	}()
+
+	err := disp.innerReceiver.ReceiveMessage(disp.formatter.Format(message, level, context), level, context)
+	if err != nil {
+		errorFunc(err)
+	}
+}
+
+// CustomReceiver implementation. Check CustomReceiver comments.
+func (disp *customReceiverDispatcher) Flush() {
+	disp.innerReceiver.Flush()
+}
+
+// CustomReceiver implementation. Check CustomReceiver comments.
+func (disp *customReceiverDispatcher) Close() error {
+	disp.innerReceiver.Flush()
+
+	err := disp.innerReceiver.Close()
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (disp *customReceiverDispatcher) String() string {
+	datas := ""
+	skeys := make([]string, 0, len(disp.usedArgs.XmlCustomAttrs))
+	for i := range disp.usedArgs.XmlCustomAttrs {
+		skeys = append(skeys, i)
+	}
+	sort.Strings(skeys)
+	for _, key := range skeys {
+		datas += fmt.Sprintf("<%s, %s> ", key, disp.usedArgs.XmlCustomAttrs[key])
+	}
+
+	str := fmt.Sprintf("Custom receiver %s [fmt='%s'],[data='%s'],[inner='%s']\n",
+		disp.customReceiverName, disp.formatter.String(), datas, disp.innerReceiver)
+
+	return str
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/dispatch_dispatcher.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/dispatch_dispatcher.go
new file mode 100644
index 00000000..2bd3b4a4
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/dispatch_dispatcher.go
@@ -0,0 +1,189 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"errors"
+	"fmt"
+	"io"
+)
+
+// A dispatcherInterface is used to dispatch message to all underlying receivers.
+// Dispatch logic depends on given context and log level. Any errors are reported using errorFunc.
+// Also, as underlying receivers may have a state, dispatcher has a ShuttingDown method which performs
+// an immediate cleanup of all data that is stored in the receivers
+type dispatcherInterface interface {
+	flusherInterface
+	io.Closer
+	Dispatch(message string, level LogLevel, context LogContextInterface, errorFunc func(err error))
+}
+
+type dispatcher struct {
+	formatter   *formatter
+	writers     []*formattedWriter
+	dispatchers []dispatcherInterface
+}
+
+// Creates a dispatcher which dispatches data to a list of receivers.
+// Each receiver should be either a Dispatcher or io.Writer, otherwise an error will be returned
+func createDispatcher(formatter *formatter, receivers []interface{}) (*dispatcher, error) {
+	if formatter == nil {
+		return nil, errors.New("formatter cannot be nil")
+	}
+	if receivers == nil || len(receivers) == 0 {
+		return nil, errors.New("receivers cannot be nil or empty")
+	}
+
+	disp := &dispatcher{formatter, make([]*formattedWriter, 0), make([]dispatcherInterface, 0)}
+	for _, receiver := range receivers {
+		writer, ok := receiver.(*formattedWriter)
+		if ok {
+			disp.writers = append(disp.writers, writer)
+			continue
+		}
+
+		ioWriter, ok := receiver.(io.Writer)
+		if ok {
+			writer, err := NewFormattedWriter(ioWriter, disp.formatter)
+			if err != nil {
+				return nil, err
+			}
+			disp.writers = append(disp.writers, writer)
+			continue
+		}
+
+		dispInterface, ok := receiver.(dispatcherInterface)
+		if ok {
+			disp.dispatchers = append(disp.dispatchers, dispInterface)
+			continue
+		}
+
+		return nil, errors.New("method can receive either io.Writer or dispatcherInterface")
+	}
+
+	return disp, nil
+}
+
+func (disp *dispatcher) Dispatch(
+	message string,
+	level LogLevel,
+	context LogContextInterface,
+	errorFunc func(err error)) {
+
+	for _, writer := range disp.writers {
+		err := writer.Write(message, level, context)
+		if err != nil {
+			errorFunc(err)
+		}
+	}
+
+	for _, dispInterface := range disp.dispatchers {
+		dispInterface.Dispatch(message, level, context, errorFunc)
+	}
+}
+
+// Flush goes through all underlying writers which implement flusherInterface interface
+// and closes them. Recursively performs the same action for underlying dispatchers
+func (disp *dispatcher) Flush() {
+	for _, disp := range disp.Dispatchers() {
+		disp.Flush()
+	}
+
+	for _, formatWriter := range disp.Writers() {
+		flusher, ok := formatWriter.Writer().(flusherInterface)
+		if ok {
+			flusher.Flush()
+		}
+	}
+}
+
+// Close goes through all underlying writers which implement io.Closer interface
+// and closes them. Recursively performs the same action for underlying dispatchers
+// Before closing, writers are flushed to prevent loss of any buffered data, so
+// a call to Flush() func before Close() is not necessary
+func (disp *dispatcher) Close() error {
+	for _, disp := range disp.Dispatchers() {
+		disp.Flush()
+		err := disp.Close()
+		if err != nil {
+			return err
+		}
+	}
+
+	for _, formatWriter := range disp.Writers() {
+		flusher, ok := formatWriter.Writer().(flusherInterface)
+		if ok {
+			flusher.Flush()
+		}
+
+		closer, ok := formatWriter.Writer().(io.Closer)
+		if ok {
+			err := closer.Close()
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func (disp *dispatcher) Writers() []*formattedWriter {
+	return disp.writers
+}
+
+func (disp *dispatcher) Dispatchers() []dispatcherInterface {
+	return disp.dispatchers
+}
+
+func (disp *dispatcher) String() string {
+	str := "formatter: " + disp.formatter.String() + "\n"
+
+	str += "    ->Dispatchers:"
+
+	if len(disp.dispatchers) == 0 {
+		str += "none\n"
+	} else {
+		str += "\n"
+
+		for _, disp := range disp.dispatchers {
+			str += fmt.Sprintf("        ->%s", disp)
+		}
+	}
+
+	str += "    ->Writers:"
+
+	if len(disp.writers) == 0 {
+		str += "none\n"
+	} else {
+		str += "\n"
+
+		for _, writer := range disp.writers {
+			str += fmt.Sprintf("        ->%s\n", writer)
+		}
+	}
+
+	return str
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/dispatch_filterdispatcher.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/dispatch_filterdispatcher.go
new file mode 100644
index 00000000..9de8a722
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/dispatch_filterdispatcher.go
@@ -0,0 +1,66 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"fmt"
+)
+
+// A filterDispatcher writes the given message to underlying receivers only if message log level
+// is in the allowed list.
+type filterDispatcher struct {
+	*dispatcher
+	allowList map[LogLevel]bool
+}
+
+// NewFilterDispatcher creates a new filterDispatcher using a list of allowed levels.
+func NewFilterDispatcher(formatter *formatter, receivers []interface{}, allowList ...LogLevel) (*filterDispatcher, error) {
+	disp, err := createDispatcher(formatter, receivers)
+	if err != nil {
+		return nil, err
+	}
+
+	allows := make(map[LogLevel]bool)
+	for _, allowLevel := range allowList {
+		allows[allowLevel] = true
+	}
+
+	return &filterDispatcher{disp, allows}, nil
+}
+
+func (filter *filterDispatcher) Dispatch(
+	message string,
+	level LogLevel,
+	context LogContextInterface,
+	errorFunc func(err error)) {
+	isAllowed, ok := filter.allowList[level]
+	if ok && isAllowed {
+		filter.dispatcher.Dispatch(message, level, context, errorFunc)
+	}
+}
+
+func (filter *filterDispatcher) String() string {
+	return fmt.Sprintf("filterDispatcher ->\n%s", filter.dispatcher)
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/dispatch_splitdispatcher.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/dispatch_splitdispatcher.go
new file mode 100644
index 00000000..1d0fe7ea
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/dispatch_splitdispatcher.go
@@ -0,0 +1,47 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"fmt"
+)
+
+// A splitDispatcher just writes the given message to underlying receivers. (Splits the message stream.)
+type splitDispatcher struct {
+	*dispatcher
+}
+
+func NewSplitDispatcher(formatter *formatter, receivers []interface{}) (*splitDispatcher, error) {
+	disp, err := createDispatcher(formatter, receivers)
+	if err != nil {
+		return nil, err
+	}
+
+	return &splitDispatcher{disp}, nil
+}
+
+func (splitter *splitDispatcher) String() string {
+	return fmt.Sprintf("splitDispatcher ->\n%s", splitter.dispatcher.String())
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/doc.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/doc.go
new file mode 100644
index 00000000..2734c9cb
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/doc.go
@@ -0,0 +1,175 @@
+// Copyright (c) 2014 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+/*
+Package seelog implements logging functionality with flexible dispatching, filtering, and formatting.
+
+Creation
+
+To create a logger, use one of the following constructors:
+  func LoggerFromConfigAsBytes
+  func LoggerFromConfigAsFile
+  func LoggerFromConfigAsString
+  func LoggerFromWriterWithMinLevel
+  func LoggerFromWriterWithMinLevelAndFormat
+  func LoggerFromCustomReceiver (check https://github.com/cihub/seelog/wiki/Custom-receivers)
+Example:
+  import log "github.com/cihub/seelog"
+
+  func main() {
+      logger, err := log.LoggerFromConfigAsFile("seelog.xml")
+      if err != nil {
+          panic(err)
+      }
+      defer logger.Flush()
+      ... use logger ...
+  }
+The "defer" line is important because if you are using asynchronous logger behavior, without this line you may end up losing some
+messages when you close your application because they are processed in another non-blocking goroutine. To avoid that you
+explicitly defer flushing all messages before closing.
+
+Usage
+
+Logger created using one of the LoggerFrom* funcs can be used directly by calling one of the main log funcs.
+Example:
+  import log "github.com/cihub/seelog"
+
+  func main() {
+      logger, err := log.LoggerFromConfigAsFile("seelog.xml")
+      if err != nil {
+          panic(err)
+      }
+      defer logger.Flush()
+      logger.Trace("test")
+      logger.Debugf("var = %s", "abc")
+  }
+
+Having loggers as variables is convenient if you are writing your own package with internal logging or if you have
+several loggers with different options.
+But for most standalone apps it is more convenient to use package level funcs and vars. There is a package level
+var 'Current' made for it. You can replace it with another logger using 'ReplaceLogger' and then use package level funcs:
+  import log "github.com/cihub/seelog"
+
+  func main() {
+      logger, err := log.LoggerFromConfigAsFile("seelog.xml")
+      if err != nil {
+          panic(err)
+      }
+      log.ReplaceLogger(logger)
+      defer log.Flush()
+      log.Trace("test")
+      log.Debugf("var = %s", "abc")
+  }
+Last lines
+      log.Trace("test")
+      log.Debugf("var = %s", "abc")
+do the same as
+      log.Current.Trace("test")
+      log.Current.Debugf("var = %s", "abc")
+In this example the 'Current' logger was replaced using a 'ReplaceLogger' call and became equal to 'logger' variable created from config.
+This way you are able to use package level funcs instead of passing the logger variable.
+
+Configuration
+
+Main seelog point is to configure logger via config files and not the code.
+The configuration is read by LoggerFrom* funcs. These funcs read xml configuration from different sources and try
+to create a logger using it.
+
+All the configuration features are covered in detail in the official wiki: https://github.com/cihub/seelog/wiki.
+There are many sections covering different aspects of seelog, but the most important for understanding configs are:
+    https://github.com/cihub/seelog/wiki/Constraints-and-exceptions
+    https://github.com/cihub/seelog/wiki/Dispatchers-and-receivers
+    https://github.com/cihub/seelog/wiki/Formatting
+    https://github.com/cihub/seelog/wiki/Logger-types
+After you understand these concepts, check the 'Reference' section on the main wiki page to get the up-to-date
+list of dispatchers, receivers, formats, and logger types.
+
+Here is an example config with all these features:
+    <seelog type="adaptive" mininterval="2000000" maxinterval="100000000" critmsgcount="500" minlevel="debug">
+        <exceptions>
+            <exception filepattern="test*" minlevel="error"/>
+        </exceptions>
+        <outputs formatid="all">
+            <file path="all.log"/>
+            <filter levels="info">
+              <console formatid="fmtinfo"/>
+            </filter>
+            <filter levels="error,critical" formatid="fmterror">
+              <console/>
+              <file path="errors.log"/>
+            </filter>
+        </outputs>
+        <formats>
+            <format id="fmtinfo" format="[%Level] [%Time] %Msg%n"/>
+            <format id="fmterror" format="[%LEVEL] [%Time] [%FuncShort @ %File.%Line] %Msg%n"/>
+            <format id="all" format="[%Level] [%Time] [@ %File.%Line] %Msg%n"/>
+            <format id="criticalemail" format="Critical error on our server!\n    %Time %Date %RelFile %Func %Msg \nSent by Seelog"/>
+        </formats>
+    </seelog>
+This config represents a logger with adaptive timeout between log messages (check logger types reference) which
+logs to console, all.log, and errors.log depending on the log level. Its output formats also depend on log level. This logger will only
+use log level 'debug' and higher (minlevel is set) for all files with names that don't start with 'test'. For files starting with 'test'
+this logger prohibits all levels below 'error'.
+
+Configuration using code
+
+Although configuration using code is not recommended, it is sometimes needed and it is possible to do with seelog. Basically, what
+you need to do to get started is to create constraints, exceptions and a dispatcher tree (same as with config). Most of the New*
+functions in this package are used to provide such capabilities.
+
+Here is an example of configuration in code, that demonstrates an async loop logger that logs to a simple split dispatcher with
+a console receiver using a specified format and is filtered using a top-level min-max constraints and one expection for
+the 'main.go' file. So, this is basically a demonstration of configuration of most of the features:
+
+  package main
+
+  import log "github.com/cihub/seelog"
+
+  func main() {
+      defer log.Flush()
+      log.Info("Hello from Seelog!")
+
+      consoleWriter, _ := log.NewConsoleWriter()
+      formatter, _ := log.NewFormatter("%Level %Msg %File%n")
+      root, _ := log.NewSplitDispatcher(formatter, []interface{}{consoleWriter})
+      constraints, _ := log.NewMinMaxConstraints(log.TraceLvl, log.CriticalLvl)
+      specificConstraints, _ := log.NewListConstraints([]log.LogLevel{log.InfoLvl, log.ErrorLvl})
+      ex, _ := log.NewLogLevelException("*", "*main.go", specificConstraints)
+      exceptions := []*log.LogLevelException{ex}
+
+      logger := log.NewAsyncLoopLogger(log.NewLoggerConfig(constraints, exceptions, root))
+      log.ReplaceLogger(logger)
+
+      log.Trace("This should not be seen")
+      log.Debug("This should not be seen")
+      log.Info("Test")
+      log.Error("Test2")
+  }
+
+Examples
+
+To learn seelog features faster you should check the examples package: https://github.com/cihub/seelog-examples
+It contains many example configs and usecases.
+*/
+package seelog
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/format.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/format.go
new file mode 100644
index 00000000..32682f34
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/format.go
@@ -0,0 +1,461 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+	"unicode"
+	"unicode/utf8"
+)
+
+// FormatterSymbol is a special symbol used in config files to mark special format aliases.
+const (
+	FormatterSymbol = '%'
+)
+
+const (
+	formatterParameterStart = '('
+	formatterParameterEnd   = ')'
+)
+
+// Time and date formats used for %Date and %Time aliases.
+const (
+	DateDefaultFormat = "2006-01-02"
+	TimeFormat        = "15:04:05"
+)
+
+var DefaultMsgFormat = "%Ns [%Level] %Msg%n"
+
+var (
+	DefaultFormatter *formatter
+	msgonlyformatter *formatter
+)
+
+func init() {
+	var err error
+	if DefaultFormatter, err = NewFormatter(DefaultMsgFormat); err != nil {
+		reportInternalError(fmt.Errorf("error during creating DefaultFormatter: %s", err))
+	}
+	if msgonlyformatter, err = NewFormatter("%Msg"); err != nil {
+		reportInternalError(fmt.Errorf("error during creating msgonlyformatter: %s", err))
+	}
+}
+
+// FormatterFunc represents one formatter object that starts with '%' sign in the 'format' attribute
+// of the 'format' config item. These special symbols are replaced with context values or special
+// strings when message is written to byte receiver.
+//
+// Check https://github.com/cihub/seelog/wiki/Formatting for details.
+// Full list (with descriptions) of formatters: https://github.com/cihub/seelog/wiki/Format-reference
+//
+// FormatterFunc takes raw log message, level, log context and returns a string, number (of any type) or any object
+// that can be evaluated as string.
+type FormatterFunc func(message string, level LogLevel, context LogContextInterface) interface{}
+
+// FormatterFuncCreator is a factory of FormatterFunc objects. It is used to generate parameterized
+// formatters (such as %Date or %EscM) and custom user formatters.
+type FormatterFuncCreator func(param string) FormatterFunc
+
+var formatterFuncs = map[string]FormatterFunc{
+	"Level":     formatterLevel,
+	"Lev":       formatterLev,
+	"LEVEL":     formatterLEVEL,
+	"LEV":       formatterLEV,
+	"l":         formatterl,
+	"Msg":       formatterMsg,
+	"FullPath":  formatterFullPath,
+	"File":      formatterFile,
+	"RelFile":   formatterRelFile,
+	"Func":      FormatterFunction,
+	"FuncShort": FormatterFunctionShort,
+	"Line":      formatterLine,
+	"Time":      formatterTime,
+	"UTCTime":   formatterUTCTime,
+	"Ns":        formatterNs,
+	"UTCNs":     formatterUTCNs,
+	"n":         formattern,
+	"t":         formattert,
+}
+
+var formatterFuncsParameterized = map[string]FormatterFuncCreator{
+	"Date":    createDateTimeFormatterFunc,
+	"UTCDate": createUTCDateTimeFormatterFunc,
+	"EscM":    createANSIEscapeFunc,
+}
+
+func errorAliasReserved(name string) error {
+	return fmt.Errorf("cannot use '%s' as custom formatter name. Name is reserved", name)
+}
+
+// RegisterCustomFormatter registers a new custom formatter factory with a given name. If returned error is nil,
+// then this name (prepended by '%' symbol) can be used in 'format' attributes in configuration and
+// it will be treated like the standard parameterized formatter identifiers.
+//
+// RegisterCustomFormatter needs to be called before creating a logger for it to take effect. The general recommendation
+// is to call it once in 'init' func of your application or any initializer func.
+//
+// For usage examples, check https://github.com/cihub/seelog/wiki/Custom-formatters.
+//
+// Name must only consist of letters (unicode.IsLetter).
+//
+// Name must not be one of the already registered standard formatter names
+// (https://github.com/cihub/seelog/wiki/Format-reference) and previously registered
+// custom format names. To avoid any potential name conflicts (in future releases), it is recommended
+// to start your custom formatter name with a namespace (e.g. 'MyCompanySomething') or a 'Custom' keyword.
+func RegisterCustomFormatter(name string, creator FormatterFuncCreator) error {
+	if _, ok := formatterFuncs[name]; ok {
+		return errorAliasReserved(name)
+	}
+	if _, ok := formatterFuncsParameterized[name]; ok {
+		return errorAliasReserved(name)
+	}
+	formatterFuncsParameterized[name] = creator
+	return nil
+}
+
+// formatter is used to write messages in a specific format, inserting such additional data
+// as log level, date/time, etc.
+type formatter struct {
+	fmtStringOriginal string
+	fmtString         string
+	formatterFuncs    []FormatterFunc
+}
+
+// NewFormatter creates a new formatter using a format string
+func NewFormatter(formatString string) (*formatter, error) {
+	fmtr := new(formatter)
+	fmtr.fmtStringOriginal = formatString
+	if err := buildFormatterFuncs(fmtr); err != nil {
+		return nil, err
+	}
+	return fmtr, nil
+}
+
+func buildFormatterFuncs(formatter *formatter) error {
+	var (
+		fsbuf  = new(bytes.Buffer)
+		fsolm1 = len(formatter.fmtStringOriginal) - 1
+	)
+	for i := 0; i <= fsolm1; i++ {
+		if char := formatter.fmtStringOriginal[i]; char != FormatterSymbol {
+			fsbuf.WriteByte(char)
+			continue
+		}
+		// Check if the index is at the end of the string.
+		if i == fsolm1 {
+			return fmt.Errorf("format error: %c cannot be last symbol", FormatterSymbol)
+		}
+		// Check if the formatter symbol is doubled and skip it as nonmatching.
+		if formatter.fmtStringOriginal[i+1] == FormatterSymbol {
+			fsbuf.WriteRune(FormatterSymbol)
+			i++
+			continue
+		}
+		function, ni, err := formatter.extractFormatterFunc(i + 1)
+		if err != nil {
+			return err
+		}
+		// Append formatting string "%v".
+		fsbuf.Write([]byte{37, 118})
+		i = ni
+		formatter.formatterFuncs = append(formatter.formatterFuncs, function)
+	}
+	formatter.fmtString = fsbuf.String()
+	return nil
+}
+
+func (formatter *formatter) extractFormatterFunc(index int) (FormatterFunc, int, error) {
+	letterSequence := formatter.extractLetterSequence(index)
+	if len(letterSequence) == 0 {
+		return nil, 0, fmt.Errorf("format error: lack of formatter after %c at %d", FormatterSymbol, index)
+	}
+
+	function, formatterLength, ok := formatter.findFormatterFunc(letterSequence)
+	if ok {
+		return function, index + formatterLength - 1, nil
+	}
+
+	function, formatterLength, ok, err := formatter.findFormatterFuncParametrized(letterSequence, index)
+	if err != nil {
+		return nil, 0, err
+	}
+	if ok {
+		return function, index + formatterLength - 1, nil
+	}
+
+	return nil, 0, errors.New("format error: unrecognized formatter at " + strconv.Itoa(index) + ": " + letterSequence)
+}
+
+func (formatter *formatter) extractLetterSequence(index int) string {
+	letters := ""
+
+	bytesToParse := []byte(formatter.fmtStringOriginal[index:])
+	runeCount := utf8.RuneCount(bytesToParse)
+	for i := 0; i < runeCount; i++ {
+		rune, runeSize := utf8.DecodeRune(bytesToParse)
+		bytesToParse = bytesToParse[runeSize:]
+
+		if unicode.IsLetter(rune) {
+			letters += string(rune)
+		} else {
+			break
+		}
+	}
+	return letters
+}
+
+func (formatter *formatter) findFormatterFunc(letters string) (FormatterFunc, int, bool) {
+	currentVerb := letters
+	for i := 0; i < len(letters); i++ {
+		function, ok := formatterFuncs[currentVerb]
+		if ok {
+			return function, len(currentVerb), ok
+		}
+		currentVerb = currentVerb[:len(currentVerb)-1]
+	}
+
+	return nil, 0, false
+}
+
+func (formatter *formatter) findFormatterFuncParametrized(letters string, lettersStartIndex int) (FormatterFunc, int, bool, error) {
+	currentVerb := letters
+	for i := 0; i < len(letters); i++ {
+		functionCreator, ok := formatterFuncsParameterized[currentVerb]
+		if ok {
+			parameter := ""
+			parameterLen := 0
+			isVerbEqualsLetters := i == 0 // if not, then letter goes after formatter, and formatter is parameterless
+			if isVerbEqualsLetters {
+				userParameter := ""
+				var err error
+				userParameter, parameterLen, ok, err = formatter.findparameter(lettersStartIndex + len(currentVerb))
+				if ok {
+					parameter = userParameter
+				} else if err != nil {
+					return nil, 0, false, err
+				}
+			}
+
+			return functionCreator(parameter), len(currentVerb) + parameterLen, true, nil
+		}
+
+		currentVerb = currentVerb[:len(currentVerb)-1]
+	}
+
+	return nil, 0, false, nil
+}
+
+func (formatter *formatter) findparameter(startIndex int) (string, int, bool, error) {
+	if len(formatter.fmtStringOriginal) == startIndex || formatter.fmtStringOriginal[startIndex] != formatterParameterStart {
+		return "", 0, false, nil
+	}
+
+	endIndex := strings.Index(formatter.fmtStringOriginal[startIndex:], string(formatterParameterEnd))
+	if endIndex == -1 {
+		return "", 0, false, fmt.Errorf("Unmatched parenthesis or invalid parameter at %d: %s",
+			startIndex, formatter.fmtStringOriginal[startIndex:])
+	}
+	endIndex += startIndex
+
+	length := endIndex - startIndex + 1
+
+	return formatter.fmtStringOriginal[startIndex+1 : endIndex], length, true, nil
+}
+
+// Format processes a message with special formatters, log level, and context. Returns formatted string
+// with all formatter identifiers changed to appropriate values.
+func (formatter *formatter) Format(message string, level LogLevel, context LogContextInterface) string {
+	if len(formatter.formatterFuncs) == 0 {
+		return formatter.fmtString
+	}
+
+	params := make([]interface{}, len(formatter.formatterFuncs))
+	for i, function := range formatter.formatterFuncs {
+		params[i] = function(message, level, context)
+	}
+
+	return fmt.Sprintf(formatter.fmtString, params...)
+}
+
+func (formatter *formatter) String() string {
+	return formatter.fmtStringOriginal
+}
+
+//=====================================================
+
+const (
+	wrongLogLevel   = "WRONG_LOGLEVEL"
+	wrongEscapeCode = "WRONG_ESCAPE"
+)
+
+var levelToString = map[LogLevel]string{
+	TraceLvl:    "Trace",
+	DebugLvl:    "Debug",
+	InfoLvl:     "Info",
+	WarnLvl:     "Warn",
+	ErrorLvl:    "Error",
+	CriticalLvl: "Critical",
+	Off:         "Off",
+}
+
+var levelToShortString = map[LogLevel]string{
+	TraceLvl:    "Trc",
+	DebugLvl:    "Dbg",
+	InfoLvl:     "Inf",
+	WarnLvl:     "Wrn",
+	ErrorLvl:    "Err",
+	CriticalLvl: "Crt",
+	Off:         "Off",
+}
+
+var levelToShortestString = map[LogLevel]string{
+	TraceLvl:    "t",
+	DebugLvl:    "d",
+	InfoLvl:     "i",
+	WarnLvl:     "w",
+	ErrorLvl:    "e",
+	CriticalLvl: "c",
+	Off:         "o",
+}
+
+func formatterLevel(message string, level LogLevel, context LogContextInterface) interface{} {
+	levelStr, ok := levelToString[level]
+	if !ok {
+		return wrongLogLevel
+	}
+	return levelStr
+}
+
+func formatterLev(message string, level LogLevel, context LogContextInterface) interface{} {
+	levelStr, ok := levelToShortString[level]
+	if !ok {
+		return wrongLogLevel
+	}
+	return levelStr
+}
+
+func formatterLEVEL(message string, level LogLevel, context LogContextInterface) interface{} {
+	return strings.ToTitle(formatterLevel(message, level, context).(string))
+}
+
+func formatterLEV(message string, level LogLevel, context LogContextInterface) interface{} {
+	return strings.ToTitle(formatterLev(message, level, context).(string))
+}
+
+func formatterl(message string, level LogLevel, context LogContextInterface) interface{} {
+	levelStr, ok := levelToShortestString[level]
+	if !ok {
+		return wrongLogLevel
+	}
+	return levelStr
+}
+
+func formatterMsg(message string, level LogLevel, context LogContextInterface) interface{} {
+	return message
+}
+
+func formatterFullPath(message string, level LogLevel, context LogContextInterface) interface{} {
+	return context.FullPath()
+}
+
+func formatterFile(message string, level LogLevel, context LogContextInterface) interface{} {
+	return context.FileName()
+}
+
+func formatterRelFile(message string, level LogLevel, context LogContextInterface) interface{} {
+	return context.ShortPath()
+}
+
+func FormatterFunction(message string, level LogLevel, context LogContextInterface) interface{} {
+	return context.Func()
+}
+
+func FormatterFunctionShort(message string, level LogLevel, context LogContextInterface) interface{} {
+	f := context.Func()
+	spl := strings.Split(f, ".")
+	return spl[len(spl)-1]
+}
+
+func formatterLine(message string, level LogLevel, context LogContextInterface) interface{} {
+	return context.Line()
+}
+
+func formatterTime(message string, level LogLevel, context LogContextInterface) interface{} {
+	return context.CallTime().Format(TimeFormat)
+}
+
+func formatterUTCTime(message string, level LogLevel, context LogContextInterface) interface{} {
+	return context.CallTime().UTC().Format(TimeFormat)
+}
+
+func formatterNs(message string, level LogLevel, context LogContextInterface) interface{} {
+	return context.CallTime().UnixNano()
+}
+
+func formatterUTCNs(message string, level LogLevel, context LogContextInterface) interface{} {
+	return context.CallTime().UTC().UnixNano()
+}
+
+func formattern(message string, level LogLevel, context LogContextInterface) interface{} {
+	return "\n"
+}
+
+func formattert(message string, level LogLevel, context LogContextInterface) interface{} {
+	return "\t"
+}
+
+func createDateTimeFormatterFunc(dateTimeFormat string) FormatterFunc {
+	format := dateTimeFormat
+	if format == "" {
+		format = DateDefaultFormat
+	}
+	return func(message string, level LogLevel, context LogContextInterface) interface{} {
+		return context.CallTime().Format(format)
+	}
+}
+
+func createUTCDateTimeFormatterFunc(dateTimeFormat string) FormatterFunc {
+	format := dateTimeFormat
+	if format == "" {
+		format = DateDefaultFormat
+	}
+	return func(message string, level LogLevel, context LogContextInterface) interface{} {
+		return context.CallTime().UTC().Format(format)
+	}
+}
+
+func createANSIEscapeFunc(escapeCodeString string) FormatterFunc {
+	return func(message string, level LogLevel, context LogContextInterface) interface{} {
+		if len(escapeCodeString) == 0 {
+			return wrongEscapeCode
+		}
+
+		return fmt.Sprintf("%c[%sm", 0x1B, escapeCodeString)
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/internals_baseerror.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/internals_baseerror.go
new file mode 100644
index 00000000..c0b271d7
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/internals_baseerror.go
@@ -0,0 +1,10 @@
+package seelog
+
+// Base struct for custom errors.
+type baseError struct {
+	message string
+}
+
+func (be baseError) Error() string {
+	return be.message
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/internals_fsutils.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/internals_fsutils.go
new file mode 100644
index 00000000..5baa6ba6
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/internals_fsutils.go
@@ -0,0 +1,403 @@
+package seelog
+
+import (
+	"archive/zip"
+	"bytes"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"sync"
+)
+
+// File and directory permitions.
+const (
+	defaultFilePermissions      = 0666
+	defaultDirectoryPermissions = 0767
+)
+
+const (
+	// Max number of directories can be read asynchronously.
+	maxDirNumberReadAsync = 1000
+)
+
+type cannotOpenFileError struct {
+	baseError
+}
+
+func newCannotOpenFileError(fname string) *cannotOpenFileError {
+	return &cannotOpenFileError{baseError{message: "Cannot open file: " + fname}}
+}
+
+type notDirectoryError struct {
+	baseError
+}
+
+func newNotDirectoryError(dname string) *notDirectoryError {
+	return &notDirectoryError{baseError{message: dname + " is not directory"}}
+}
+
+// fileFilter is a filtering criteria function for '*os.File'.
+// Must return 'false' to set aside the given file.
+type fileFilter func(os.FileInfo, *os.File) bool
+
+// filePathFilter is a filtering creteria function for file path.
+// Must return 'false' to set aside the given file.
+type filePathFilter func(filePath string) bool
+
+// GetSubdirNames returns a list of directories found in
+// the given one with dirPath.
+func getSubdirNames(dirPath string) ([]string, error) {
+	fi, err := os.Stat(dirPath)
+	if err != nil {
+		return nil, err
+	}
+	if !fi.IsDir() {
+		return nil, newNotDirectoryError(dirPath)
+	}
+	dd, err := os.Open(dirPath)
+	// Cannot open file.
+	if err != nil {
+		if dd != nil {
+			dd.Close()
+		}
+		return nil, err
+	}
+	defer dd.Close()
+	// TODO: Improve performance by buffering reading.
+	allEntities, err := dd.Readdir(-1)
+	if err != nil {
+		return nil, err
+	}
+	subDirs := []string{}
+	for _, entity := range allEntities {
+		if entity.IsDir() {
+			subDirs = append(subDirs, entity.Name())
+		}
+	}
+	return subDirs, nil
+}
+
+// getSubdirAbsPaths recursively visit all the subdirectories
+// starting from the given directory and returns absolute paths for them.
+func getAllSubdirAbsPaths(dirPath string) (res []string, err error) {
+	dps, err := getSubdirAbsPaths(dirPath)
+	if err != nil {
+		res = []string{}
+		return
+	}
+	res = append(res, dps...)
+	for _, dp := range dps {
+		sdps, err := getAllSubdirAbsPaths(dp)
+		if err != nil {
+			return []string{}, err
+		}
+		res = append(res, sdps...)
+	}
+	return
+}
+
+// getSubdirAbsPaths supplies absolute paths for all subdirectiries in a given directory.
+// Input: (I1) dirPath - absolute path of a directory in question.
+// Out: (O1) - slice of subdir asbolute paths; (O2) - error of the operation.
+// Remark: If error (O2) is non-nil then (O1) is nil and vice versa.
+func getSubdirAbsPaths(dirPath string) ([]string, error) {
+	sdns, err := getSubdirNames(dirPath)
+	if err != nil {
+		return nil, err
+	}
+	rsdns := []string{}
+	for _, sdn := range sdns {
+		rsdns = append(rsdns, filepath.Join(dirPath, sdn))
+	}
+	return rsdns, nil
+}
+
+// getOpenFilesInDir supplies a slice of os.File pointers to files located in the directory.
+// Remark: Ignores files for which fileFilter returns false
+func getOpenFilesInDir(dirPath string, fFilter fileFilter) ([]*os.File, error) {
+	dfi, err := os.Open(dirPath)
+	if err != nil {
+		return nil, newCannotOpenFileError("Cannot open directory " + dirPath)
+	}
+	defer dfi.Close()
+	// Size of read buffer (i.e. chunk of items read at a time).
+	rbs := 64
+	resFiles := []*os.File{}
+L:
+	for {
+		// Read directory entities by reasonable chuncks
+		// to prevent overflows on big number of files.
+		fis, e := dfi.Readdir(rbs)
+		switch e {
+		// It's OK.
+		case nil:
+		// Do nothing, just continue cycle.
+		case io.EOF:
+			break L
+		// Something went wrong.
+		default:
+			return nil, e
+		}
+		// THINK: Maybe, use async running.
+		for _, fi := range fis {
+			// NB: On Linux this could be a problem as
+			// there are lots of file types available.
+			if !fi.IsDir() {
+				f, e := os.Open(filepath.Join(dirPath, fi.Name()))
+				if e != nil {
+					if f != nil {
+						f.Close()
+					}
+					// THINK: Add nil as indicator that a problem occurred.
+					resFiles = append(resFiles, nil)
+					continue
+				}
+				// Check filter condition.
+				if fFilter != nil && !fFilter(fi, f) {
+					continue
+				}
+				resFiles = append(resFiles, f)
+			}
+		}
+	}
+	return resFiles, nil
+}
+
+func isRegular(m os.FileMode) bool {
+	return m&os.ModeType == 0
+}
+
+// getDirFilePaths return full paths of the files located in the directory.
+// Remark: Ignores files for which fileFilter returns false.
+func getDirFilePaths(dirPath string, fpFilter filePathFilter, pathIsName bool) ([]string, error) {
+	dfi, err := os.Open(dirPath)
+	if err != nil {
+		return nil, newCannotOpenFileError("Cannot open directory " + dirPath)
+	}
+	defer dfi.Close()
+
+	var absDirPath string
+	if !filepath.IsAbs(dirPath) {
+		absDirPath, err = filepath.Abs(dirPath)
+		if err != nil {
+			return nil, fmt.Errorf("cannot get absolute path of directory: %s", err.Error())
+		}
+	} else {
+		absDirPath = dirPath
+	}
+
+	// TODO: check if dirPath is really directory.
+	// Size of read buffer (i.e. chunk of items read at a time).
+	rbs := 2 << 5
+	filePaths := []string{}
+
+	var fp string
+L:
+	for {
+		// Read directory entities by reasonable chuncks
+		// to prevent overflows on big number of files.
+		fis, e := dfi.Readdir(rbs)
+		switch e {
+		// It's OK.
+		case nil:
+		// Do nothing, just continue cycle.
+		case io.EOF:
+			break L
+		// Indicate that something went wrong.
+		default:
+			return nil, e
+		}
+		// THINK: Maybe, use async running.
+		for _, fi := range fis {
+			// NB: Should work on every Windows and non-Windows OS.
+			if isRegular(fi.Mode()) {
+				if pathIsName {
+					fp = fi.Name()
+				} else {
+					// Build full path of a file.
+					fp = filepath.Join(absDirPath, fi.Name())
+				}
+				// Check filter condition.
+				if fpFilter != nil && !fpFilter(fp) {
+					continue
+				}
+				filePaths = append(filePaths, fp)
+			}
+		}
+	}
+	return filePaths, nil
+}
+
+// getOpenFilesByDirectoryAsync runs async reading directories 'dirPaths' and inserts pairs
+// in map 'filesInDirMap': Key - directory name, value - *os.File slice.
+func getOpenFilesByDirectoryAsync(
+	dirPaths []string,
+	fFilter fileFilter,
+	filesInDirMap map[string][]*os.File,
+) error {
+	n := len(dirPaths)
+	if n > maxDirNumberReadAsync {
+		return fmt.Errorf("number of input directories to be read exceeded max value %d", maxDirNumberReadAsync)
+	}
+	type filesInDirResult struct {
+		DirName string
+		Files   []*os.File
+		Error   error
+	}
+	dirFilesChan := make(chan *filesInDirResult, n)
+	var wg sync.WaitGroup
+	// Register n goroutines which are going to do work.
+	wg.Add(n)
+	for i := 0; i < n; i++ {
+		// Launch asynchronously the piece of work.
+		go func(dirPath string) {
+			fs, e := getOpenFilesInDir(dirPath, fFilter)
+			dirFilesChan <- &filesInDirResult{filepath.Base(dirPath), fs, e}
+			// Mark the current goroutine as finished (work is done).
+			wg.Done()
+		}(dirPaths[i])
+	}
+	// Wait for all goroutines to finish their work.
+	wg.Wait()
+	// Close the error channel to let for-range clause
+	// get all the buffered values without blocking and quit in the end.
+	close(dirFilesChan)
+	for fidr := range dirFilesChan {
+		if fidr.Error == nil {
+			// THINK: What will happen if the key is already present?
+			filesInDirMap[fidr.DirName] = fidr.Files
+		} else {
+			return fidr.Error
+		}
+	}
+	return nil
+}
+
+func copyFile(sf *os.File, dst string) (int64, error) {
+	df, err := os.Create(dst)
+	if err != nil {
+		return 0, err
+	}
+	defer df.Close()
+	return io.Copy(df, sf)
+}
+
+// fileExists return flag whether a given file exists
+// and operation error if an unclassified failure occurs.
+func fileExists(path string) (bool, error) {
+	_, err := os.Stat(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return false, nil
+		}
+		return false, err
+	}
+	return true, nil
+}
+
+// createDirectory makes directory with a given name
+// making all parent directories if necessary.
+func createDirectory(dirPath string) error {
+	var dPath string
+	var err error
+	if !filepath.IsAbs(dirPath) {
+		dPath, err = filepath.Abs(dirPath)
+		if err != nil {
+			return err
+		}
+	} else {
+		dPath = dirPath
+	}
+	exists, err := fileExists(dPath)
+	if err != nil {
+		return err
+	}
+	if exists {
+		return nil
+	}
+	return os.MkdirAll(dPath, os.ModeDir)
+}
+
+// tryRemoveFile gives a try removing the file
+// only ignoring an error when the file does not exist.
+func tryRemoveFile(filePath string) (err error) {
+	err = os.Remove(filePath)
+	if os.IsNotExist(err) {
+		err = nil
+		return
+	}
+	return
+}
+
+// Unzips a specified zip file. Returns filename->filebytes map.
+func unzip(archiveName string) (map[string][]byte, error) {
+	// Open a zip archive for reading.
+	r, err := zip.OpenReader(archiveName)
+	if err != nil {
+		return nil, err
+	}
+	defer r.Close()
+
+	// Files to be added to archive
+	// map file name to contents
+	files := make(map[string][]byte)
+
+	// Iterate through the files in the archive,
+	// printing some of their contents.
+	for _, f := range r.File {
+		rc, err := f.Open()
+		if err != nil {
+			return nil, err
+		}
+
+		bts, err := ioutil.ReadAll(rc)
+		rcErr := rc.Close()
+
+		if err != nil {
+			return nil, err
+		}
+		if rcErr != nil {
+			return nil, rcErr
+		}
+
+		files[f.Name] = bts
+	}
+
+	return files, nil
+}
+
+// Creates a zip file with the specified file names and byte contents.
+func createZip(archiveName string, files map[string][]byte) error {
+	// Create a buffer to write our archive to.
+	buf := new(bytes.Buffer)
+
+	// Create a new zip archive.
+	w := zip.NewWriter(buf)
+
+	// Write files
+	for fpath, fcont := range files {
+		f, err := w.Create(fpath)
+		if err != nil {
+			return err
+		}
+		_, err = f.Write([]byte(fcont))
+		if err != nil {
+			return err
+		}
+	}
+
+	// Make sure to check the error on Close.
+	err := w.Close()
+	if err != nil {
+		return err
+	}
+
+	err = ioutil.WriteFile(archiveName, buf.Bytes(), defaultFilePermissions)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/internals_xmlnode.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/internals_xmlnode.go
new file mode 100644
index 00000000..98588493
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/internals_xmlnode.go
@@ -0,0 +1,175 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"encoding/xml"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+)
+
+type xmlNode struct {
+	name       string
+	attributes map[string]string
+	children   []*xmlNode
+	value      string
+}
+
+func newNode() *xmlNode {
+	node := new(xmlNode)
+	node.children = make([]*xmlNode, 0)
+	node.attributes = make(map[string]string)
+	return node
+}
+
+func (node *xmlNode) String() string {
+	str := fmt.Sprintf("<%s", node.name)
+
+	for attrName, attrVal := range node.attributes {
+		str += fmt.Sprintf(" %s=\"%s\"", attrName, attrVal)
+	}
+
+	str += ">"
+	str += node.value
+
+	if len(node.children) != 0 {
+		for _, child := range node.children {
+			str += fmt.Sprintf("%s", child)
+		}
+	}
+
+	str += fmt.Sprintf("</%s>", node.name)
+
+	return str
+}
+
+func (node *xmlNode) unmarshal(startEl xml.StartElement) error {
+	node.name = startEl.Name.Local
+
+	for _, v := range startEl.Attr {
+		_, alreadyExists := node.attributes[v.Name.Local]
+		if alreadyExists {
+			return errors.New("tag '" + node.name + "' has duplicated attribute: '" + v.Name.Local + "'")
+		}
+		node.attributes[v.Name.Local] = v.Value
+	}
+
+	return nil
+}
+
+func (node *xmlNode) add(child *xmlNode) {
+	if node.children == nil {
+		node.children = make([]*xmlNode, 0)
+	}
+
+	node.children = append(node.children, child)
+}
+
+func (node *xmlNode) hasChildren() bool {
+	return node.children != nil && len(node.children) > 0
+}
+
+//=============================================
+
+func unmarshalConfig(reader io.Reader) (*xmlNode, error) {
+	xmlParser := xml.NewDecoder(reader)
+
+	config, err := unmarshalNode(xmlParser, nil)
+	if err != nil {
+		return nil, err
+	}
+	if config == nil {
+		return nil, errors.New("xml has no content")
+	}
+
+	nextConfigEntry, err := unmarshalNode(xmlParser, nil)
+	if nextConfigEntry != nil {
+		return nil, errors.New("xml contains more than one root element")
+	}
+
+	return config, nil
+}
+
+func unmarshalNode(xmlParser *xml.Decoder, curToken xml.Token) (node *xmlNode, err error) {
+	firstLoop := true
+	for {
+		var tok xml.Token
+		if firstLoop && curToken != nil {
+			tok = curToken
+			firstLoop = false
+		} else {
+			tok, err = getNextToken(xmlParser)
+			if err != nil || tok == nil {
+				return
+			}
+		}
+
+		switch tt := tok.(type) {
+		case xml.SyntaxError:
+			err = errors.New(tt.Error())
+			return
+		case xml.CharData:
+			value := strings.TrimSpace(string([]byte(tt)))
+			if node != nil {
+				node.value += value
+			}
+		case xml.StartElement:
+			if node == nil {
+				node = newNode()
+				err := node.unmarshal(tt)
+				if err != nil {
+					return nil, err
+				}
+			} else {
+				childNode, childErr := unmarshalNode(xmlParser, tok)
+				if childErr != nil {
+					return nil, childErr
+				}
+
+				if childNode != nil {
+					node.add(childNode)
+				} else {
+					return
+				}
+			}
+		case xml.EndElement:
+			return
+		}
+	}
+}
+
+func getNextToken(xmlParser *xml.Decoder) (tok xml.Token, err error) {
+	if tok, err = xmlParser.Token(); err != nil {
+		if err == io.EOF {
+			err = nil
+			return
+		}
+		return
+	}
+
+	return
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/log.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/log.go
new file mode 100644
index 00000000..f775e1fd
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/log.go
@@ -0,0 +1,307 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"errors"
+	"fmt"
+	"sync"
+	"time"
+)
+
+const (
+	staticFuncCallDepth = 3 // See 'commonLogger.log' method comments
+	loggerFuncCallDepth = 3
+)
+
+// Current is the logger used in all package level convenience funcs like 'Trace', 'Debug', 'Flush', etc.
+var Current LoggerInterface
+
+// Default logger that is created from an empty config: "<seelog/>". It is not closed by a ReplaceLogger call.
+var Default LoggerInterface
+
+// Disabled logger that doesn't produce any output in any circumstances. It is neither closed nor flushed by a ReplaceLogger call.
+var Disabled LoggerInterface
+
+var pkgOperationsMutex *sync.Mutex
+
+func init() {
+	pkgOperationsMutex = new(sync.Mutex)
+	var err error
+
+	if Default == nil {
+		Default, err = LoggerFromConfigAsBytes([]byte("<seelog />"))
+	}
+
+	if Disabled == nil {
+		Disabled, err = LoggerFromConfigAsBytes([]byte("<seelog levels=\"off\"/>"))
+	}
+
+	if err != nil {
+		panic(fmt.Sprintf("Seelog couldn't start. Error: %s", err.Error()))
+	}
+
+	Current = Default
+}
+
+func createLoggerFromFullConfig(config *configForParsing) (LoggerInterface, error) {
+	if config.LogType == syncloggerTypeFromString {
+		return NewSyncLogger(&config.logConfig), nil
+	} else if config.LogType == asyncLooploggerTypeFromString {
+		return NewAsyncLoopLogger(&config.logConfig), nil
+	} else if config.LogType == asyncTimerloggerTypeFromString {
+		logData := config.LoggerData
+		if logData == nil {
+			return nil, errors.New("async timer data not set")
+		}
+
+		asyncInt, ok := logData.(asyncTimerLoggerData)
+		if !ok {
+			return nil, errors.New("invalid async timer data")
+		}
+
+		logger, err := NewAsyncTimerLogger(&config.logConfig, time.Duration(asyncInt.AsyncInterval))
+		if !ok {
+			return nil, err
+		}
+
+		return logger, nil
+	} else if config.LogType == adaptiveLoggerTypeFromString {
+		logData := config.LoggerData
+		if logData == nil {
+			return nil, errors.New("adaptive logger parameters not set")
+		}
+
+		adaptData, ok := logData.(adaptiveLoggerData)
+		if !ok {
+			return nil, errors.New("invalid adaptive logger parameters")
+		}
+
+		logger, err := NewAsyncAdaptiveLogger(
+			&config.logConfig,
+			time.Duration(adaptData.MinInterval),
+			time.Duration(adaptData.MaxInterval),
+			adaptData.CriticalMsgCount,
+		)
+		if err != nil {
+			return nil, err
+		}
+
+		return logger, nil
+	}
+	return nil, errors.New("invalid config log type/data")
+}
+
+// UseLogger sets the 'Current' package level logger variable to the specified value.
+// This variable is used in all Trace/Debug/... package level convenience funcs.
+//
+// Example:
+//
+// after calling
+//     seelog.UseLogger(somelogger)
+// the following:
+//     seelog.Debug("abc")
+// will be equal to
+//     somelogger.Debug("abc")
+//
+// IMPORTANT: UseLogger do NOT close the previous logger (only flushes it). So if
+// you constantly use it to replace loggers and don't close them in other code, you'll
+// end up having memory leaks.
+//
+// To safely replace loggers, use ReplaceLogger.
+func UseLogger(logger LoggerInterface) error {
+	if logger == nil {
+		return errors.New("logger can not be nil")
+	}
+
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+
+	oldLogger := Current
+	Current = logger
+
+	if oldLogger != nil {
+		oldLogger.Flush()
+	}
+
+	return nil
+}
+
+// ReplaceLogger acts as UseLogger but the logger that was previously
+// used is disposed (except Default and Disabled loggers).
+//
+// Example:
+//     import log "github.com/cihub/seelog"
+//
+//     func main() {
+//         logger, err := log.LoggerFromConfigAsFile("seelog.xml")
+//
+//         if err != nil {
+//             panic(err)
+//         }
+//
+//         log.ReplaceLogger(logger)
+//         defer log.Flush()
+//
+//         log.Trace("test")
+//         log.Debugf("var = %s", "abc")
+//     }
+func ReplaceLogger(logger LoggerInterface) error {
+	if logger == nil {
+		return errors.New("logger can not be nil")
+	}
+
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+
+	defer func() {
+		if err := recover(); err != nil {
+			reportInternalError(fmt.Errorf("recovered from panic during ReplaceLogger: %s", err))
+		}
+	}()
+
+	if Current == Default {
+		Current.Flush()
+	} else if Current != nil && !Current.Closed() && Current != Disabled {
+		Current.Flush()
+		Current.Close()
+	}
+
+	Current = logger
+
+	return nil
+}
+
+// Tracef formats message according to format specifier
+// and writes to default logger with log level = Trace.
+func Tracef(format string, params ...interface{}) {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	Current.traceWithCallDepth(staticFuncCallDepth, newLogFormattedMessage(format, params))
+}
+
+// Debugf formats message according to format specifier
+// and writes to default logger with log level = Debug.
+func Debugf(format string, params ...interface{}) {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	Current.debugWithCallDepth(staticFuncCallDepth, newLogFormattedMessage(format, params))
+}
+
+// Infof formats message according to format specifier
+// and writes to default logger with log level = Info.
+func Infof(format string, params ...interface{}) {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	Current.infoWithCallDepth(staticFuncCallDepth, newLogFormattedMessage(format, params))
+}
+
+// Warnf formats message according to format specifier and writes to default logger with log level = Warn
+func Warnf(format string, params ...interface{}) error {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	message := newLogFormattedMessage(format, params)
+	Current.warnWithCallDepth(staticFuncCallDepth, message)
+	return errors.New(message.String())
+}
+
+// Errorf formats message according to format specifier and writes to default logger with log level = Error
+func Errorf(format string, params ...interface{}) error {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	message := newLogFormattedMessage(format, params)
+	Current.errorWithCallDepth(staticFuncCallDepth, message)
+	return errors.New(message.String())
+}
+
+// Criticalf formats message according to format specifier and writes to default logger with log level = Critical
+func Criticalf(format string, params ...interface{}) error {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	message := newLogFormattedMessage(format, params)
+	Current.criticalWithCallDepth(staticFuncCallDepth, message)
+	return errors.New(message.String())
+}
+
+// Trace formats message using the default formats for its operands and writes to default logger with log level = Trace
+func Trace(v ...interface{}) {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	Current.traceWithCallDepth(staticFuncCallDepth, newLogMessage(v))
+}
+
+// Debug formats message using the default formats for its operands and writes to default logger with log level = Debug
+func Debug(v ...interface{}) {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	Current.debugWithCallDepth(staticFuncCallDepth, newLogMessage(v))
+}
+
+// Info formats message using the default formats for its operands and writes to default logger with log level = Info
+func Info(v ...interface{}) {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	Current.infoWithCallDepth(staticFuncCallDepth, newLogMessage(v))
+}
+
+// Warn formats message using the default formats for its operands and writes to default logger with log level = Warn
+func Warn(v ...interface{}) error {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	message := newLogMessage(v)
+	Current.warnWithCallDepth(staticFuncCallDepth, message)
+	return errors.New(message.String())
+}
+
+// Error formats message using the default formats for its operands and writes to default logger with log level = Error
+func Error(v ...interface{}) error {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	message := newLogMessage(v)
+	Current.errorWithCallDepth(staticFuncCallDepth, message)
+	return errors.New(message.String())
+}
+
+// Critical formats message using the default formats for its operands and writes to default logger with log level = Critical
+func Critical(v ...interface{}) error {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	message := newLogMessage(v)
+	Current.criticalWithCallDepth(staticFuncCallDepth, message)
+	return errors.New(message.String())
+}
+
+// Flush immediately processes all currently queued messages and all currently buffered messages.
+// It is a blocking call which returns only after the queue is empty and all the buffers are empty.
+//
+// If Flush is called for a synchronous logger (type='sync'), it only flushes buffers (e.g. '<buffered>' receivers)
+// , because there is no queue.
+//
+// Call this method when your app is going to shut down not to lose any log messages.
+func Flush() {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	Current.Flush()
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/logger.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/logger.go
new file mode 100644
index 00000000..fc96aed4
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/logger.go
@@ -0,0 +1,370 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"sync"
+)
+
+func reportInternalError(err error) {
+	fmt.Fprintf(os.Stderr, "seelog internal error: %s\n", err)
+}
+
+// LoggerInterface represents structs capable of logging Seelog messages
+type LoggerInterface interface {
+
+	// Tracef formats message according to format specifier
+	// and writes to log with level = Trace.
+	Tracef(format string, params ...interface{})
+
+	// Debugf formats message according to format specifier
+	// and writes to log with level = Debug.
+	Debugf(format string, params ...interface{})
+
+	// Infof formats message according to format specifier
+	// and writes to log with level = Info.
+	Infof(format string, params ...interface{})
+
+	// Warnf formats message according to format specifier
+	// and writes to log with level = Warn.
+	Warnf(format string, params ...interface{}) error
+
+	// Errorf formats message according to format specifier
+	// and writes to log with level = Error.
+	Errorf(format string, params ...interface{}) error
+
+	// Criticalf formats message according to format specifier
+	// and writes to log with level = Critical.
+	Criticalf(format string, params ...interface{}) error
+
+	// Trace formats message using the default formats for its operands
+	// and writes to log with level = Trace
+	Trace(v ...interface{})
+
+	// Debug formats message using the default formats for its operands
+	// and writes to log with level = Debug
+	Debug(v ...interface{})
+
+	// Info formats message using the default formats for its operands
+	// and writes to log with level = Info
+	Info(v ...interface{})
+
+	// Warn formats message using the default formats for its operands
+	// and writes to log with level = Warn
+	Warn(v ...interface{}) error
+
+	// Error formats message using the default formats for its operands
+	// and writes to log with level = Error
+	Error(v ...interface{}) error
+
+	// Critical formats message using the default formats for its operands
+	// and writes to log with level = Critical
+	Critical(v ...interface{}) error
+
+	traceWithCallDepth(callDepth int, message fmt.Stringer)
+	debugWithCallDepth(callDepth int, message fmt.Stringer)
+	infoWithCallDepth(callDepth int, message fmt.Stringer)
+	warnWithCallDepth(callDepth int, message fmt.Stringer)
+	errorWithCallDepth(callDepth int, message fmt.Stringer)
+	criticalWithCallDepth(callDepth int, message fmt.Stringer)
+
+	// Close flushes all the messages in the logger and closes it. It cannot be used after this operation.
+	Close()
+
+	// Flush flushes all the messages in the logger.
+	Flush()
+
+	// Closed returns true if the logger was previously closed.
+	Closed() bool
+
+	// SetAdditionalStackDepth sets the additional number of frames to skip by runtime.Caller
+	// when getting function information needed to print seelog format identifiers such as %Func or %File.
+	//
+	// This func may be used when you wrap seelog funcs and want to print caller info of you own
+	// wrappers instead of seelog func callers. In this case you should set depth = 1. If you then
+	// wrap your wrapper, you should set depth = 2, etc.
+	//
+	// NOTE: Incorrect depth value may lead to errors in runtime.Caller evaluation or incorrect
+	// function/file names in log files. Do not use it if you are not going to wrap seelog funcs.
+	// You may reset the value to default using a SetAdditionalStackDepth(0) call.
+	SetAdditionalStackDepth(depth int) error
+
+	// Sets logger context that can be used in formatter funcs and custom receivers
+	SetContext(context interface{})
+}
+
+// innerLoggerInterface is an internal logging interface
+type innerLoggerInterface interface {
+	innerLog(level LogLevel, context LogContextInterface, message fmt.Stringer)
+	Flush()
+}
+
+// [file path][func name][level] -> [allowed]
+type allowedContextCache map[string]map[string]map[LogLevel]bool
+
+// commonLogger contains all common data needed for logging and contains methods used to log messages.
+type commonLogger struct {
+	config        *logConfig          // Config used for logging
+	contextCache  allowedContextCache // Caches whether log is enabled for specific "full path-func name-level" sets
+	closed        bool                // 'true' when all writers are closed, all data is flushed, logger is unusable. Must be accessed while holding closedM
+	closedM       sync.RWMutex
+	m             sync.Mutex // Mutex for main operations
+	unusedLevels  []bool
+	innerLogger   innerLoggerInterface
+	addStackDepth int // Additional stack depth needed for correct seelog caller context detection
+	customContext interface{}
+}
+
+func newCommonLogger(config *logConfig, internalLogger innerLoggerInterface) *commonLogger {
+	cLogger := new(commonLogger)
+
+	cLogger.config = config
+	cLogger.contextCache = make(allowedContextCache)
+	cLogger.unusedLevels = make([]bool, Off)
+	cLogger.fillUnusedLevels()
+	cLogger.innerLogger = internalLogger
+
+	return cLogger
+}
+
+func (cLogger *commonLogger) SetAdditionalStackDepth(depth int) error {
+	if depth < 0 {
+		return fmt.Errorf("negative depth: %d", depth)
+	}
+	cLogger.m.Lock()
+	cLogger.addStackDepth = depth
+	cLogger.m.Unlock()
+	return nil
+}
+
+func (cLogger *commonLogger) Tracef(format string, params ...interface{}) {
+	cLogger.traceWithCallDepth(loggerFuncCallDepth, newLogFormattedMessage(format, params))
+}
+
+func (cLogger *commonLogger) Debugf(format string, params ...interface{}) {
+	cLogger.debugWithCallDepth(loggerFuncCallDepth, newLogFormattedMessage(format, params))
+}
+
+func (cLogger *commonLogger) Infof(format string, params ...interface{}) {
+	cLogger.infoWithCallDepth(loggerFuncCallDepth, newLogFormattedMessage(format, params))
+}
+
+func (cLogger *commonLogger) Warnf(format string, params ...interface{}) error {
+	message := newLogFormattedMessage(format, params)
+	cLogger.warnWithCallDepth(loggerFuncCallDepth, message)
+	return errors.New(message.String())
+}
+
+func (cLogger *commonLogger) Errorf(format string, params ...interface{}) error {
+	message := newLogFormattedMessage(format, params)
+	cLogger.errorWithCallDepth(loggerFuncCallDepth, message)
+	return errors.New(message.String())
+}
+
+func (cLogger *commonLogger) Criticalf(format string, params ...interface{}) error {
+	message := newLogFormattedMessage(format, params)
+	cLogger.criticalWithCallDepth(loggerFuncCallDepth, message)
+	return errors.New(message.String())
+}
+
+func (cLogger *commonLogger) Trace(v ...interface{}) {
+	cLogger.traceWithCallDepth(loggerFuncCallDepth, newLogMessage(v))
+}
+
+func (cLogger *commonLogger) Debug(v ...interface{}) {
+	cLogger.debugWithCallDepth(loggerFuncCallDepth, newLogMessage(v))
+}
+
+func (cLogger *commonLogger) Info(v ...interface{}) {
+	cLogger.infoWithCallDepth(loggerFuncCallDepth, newLogMessage(v))
+}
+
+func (cLogger *commonLogger) Warn(v ...interface{}) error {
+	message := newLogMessage(v)
+	cLogger.warnWithCallDepth(loggerFuncCallDepth, message)
+	return errors.New(message.String())
+}
+
+func (cLogger *commonLogger) Error(v ...interface{}) error {
+	message := newLogMessage(v)
+	cLogger.errorWithCallDepth(loggerFuncCallDepth, message)
+	return errors.New(message.String())
+}
+
+func (cLogger *commonLogger) Critical(v ...interface{}) error {
+	message := newLogMessage(v)
+	cLogger.criticalWithCallDepth(loggerFuncCallDepth, message)
+	return errors.New(message.String())
+}
+
+func (cLogger *commonLogger) SetContext(c interface{}) {
+	cLogger.customContext = c
+}
+
+func (cLogger *commonLogger) traceWithCallDepth(callDepth int, message fmt.Stringer) {
+	cLogger.log(TraceLvl, message, callDepth)
+}
+
+func (cLogger *commonLogger) debugWithCallDepth(callDepth int, message fmt.Stringer) {
+	cLogger.log(DebugLvl, message, callDepth)
+}
+
+func (cLogger *commonLogger) infoWithCallDepth(callDepth int, message fmt.Stringer) {
+	cLogger.log(InfoLvl, message, callDepth)
+}
+
+func (cLogger *commonLogger) warnWithCallDepth(callDepth int, message fmt.Stringer) {
+	cLogger.log(WarnLvl, message, callDepth)
+}
+
+func (cLogger *commonLogger) errorWithCallDepth(callDepth int, message fmt.Stringer) {
+	cLogger.log(ErrorLvl, message, callDepth)
+}
+
+func (cLogger *commonLogger) criticalWithCallDepth(callDepth int, message fmt.Stringer) {
+	cLogger.log(CriticalLvl, message, callDepth)
+	cLogger.innerLogger.Flush()
+}
+
+func (cLogger *commonLogger) Closed() bool {
+	cLogger.closedM.RLock()
+	defer cLogger.closedM.RUnlock()
+	return cLogger.closed
+}
+
+func (cLogger *commonLogger) fillUnusedLevels() {
+	for i := 0; i < len(cLogger.unusedLevels); i++ {
+		cLogger.unusedLevels[i] = true
+	}
+
+	cLogger.fillUnusedLevelsByContraint(cLogger.config.Constraints)
+
+	for _, exception := range cLogger.config.Exceptions {
+		cLogger.fillUnusedLevelsByContraint(exception)
+	}
+}
+
+func (cLogger *commonLogger) fillUnusedLevelsByContraint(constraint logLevelConstraints) {
+	for i := 0; i < len(cLogger.unusedLevels); i++ {
+		if constraint.IsAllowed(LogLevel(i)) {
+			cLogger.unusedLevels[i] = false
+		}
+	}
+}
+
+// stackCallDepth is used to indicate the call depth of 'log' func.
+// This depth level is used in the runtime.Caller(...) call. See
+// common_context.go -> specifyContext, extractCallerInfo for details.
+func (cLogger *commonLogger) log(level LogLevel, message fmt.Stringer, stackCallDepth int) {
+	if cLogger.unusedLevels[level] {
+		return
+	}
+	cLogger.m.Lock()
+	defer cLogger.m.Unlock()
+
+	if cLogger.Closed() {
+		return
+	}
+	context, _ := specifyContext(stackCallDepth+cLogger.addStackDepth, cLogger.customContext)
+	// Context errors are not reported because there are situations
+	// in which context errors are normal Seelog usage cases. For
+	// example in executables with stripped symbols.
+	// Error contexts are returned instead. See common_context.go.
+	/*if err != nil {
+		reportInternalError(err)
+		return
+	}*/
+	cLogger.innerLogger.innerLog(level, context, message)
+}
+
+func (cLogger *commonLogger) processLogMsg(level LogLevel, message fmt.Stringer, context LogContextInterface) {
+	defer func() {
+		if err := recover(); err != nil {
+			reportInternalError(fmt.Errorf("recovered from panic during message processing: %s", err))
+		}
+	}()
+	if cLogger.config.IsAllowed(level, context) {
+		cLogger.config.RootDispatcher.Dispatch(message.String(), level, context, reportInternalError)
+	}
+}
+
+func (cLogger *commonLogger) isAllowed(level LogLevel, context LogContextInterface) bool {
+	funcMap, ok := cLogger.contextCache[context.FullPath()]
+	if !ok {
+		funcMap = make(map[string]map[LogLevel]bool, 0)
+		cLogger.contextCache[context.FullPath()] = funcMap
+	}
+
+	levelMap, ok := funcMap[context.Func()]
+	if !ok {
+		levelMap = make(map[LogLevel]bool, 0)
+		funcMap[context.Func()] = levelMap
+	}
+
+	isAllowValue, ok := levelMap[level]
+	if !ok {
+		isAllowValue = cLogger.config.IsAllowed(level, context)
+		levelMap[level] = isAllowValue
+	}
+
+	return isAllowValue
+}
+
+type logMessage struct {
+	params []interface{}
+}
+
+type logFormattedMessage struct {
+	format string
+	params []interface{}
+}
+
+func newLogMessage(params []interface{}) fmt.Stringer {
+	message := new(logMessage)
+
+	message.params = params
+
+	return message
+}
+
+func newLogFormattedMessage(format string, params []interface{}) *logFormattedMessage {
+	message := new(logFormattedMessage)
+
+	message.params = params
+	message.format = format
+
+	return message
+}
+
+func (message *logMessage) String() string {
+	return fmt.Sprint(message.params...)
+}
+
+func (message *logFormattedMessage) String() string {
+	return fmt.Sprintf(message.format, message.params...)
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/writers_bufferedwriter.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/writers_bufferedwriter.go
new file mode 100644
index 00000000..37d75c82
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/writers_bufferedwriter.go
@@ -0,0 +1,161 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"io"
+	"sync"
+	"time"
+)
+
+// bufferedWriter stores data in memory and flushes it every flushPeriod or when buffer is full
+type bufferedWriter struct {
+	flushPeriod time.Duration // data flushes interval (in microseconds)
+	bufferMutex *sync.Mutex   // mutex for buffer operations syncronization
+	innerWriter io.Writer     // inner writer
+	buffer      *bufio.Writer // buffered wrapper for inner writer
+	bufferSize  int           // max size of data chunk in bytes
+}
+
+// NewBufferedWriter creates a new buffered writer struct.
+// bufferSize -- size of memory buffer in bytes
+// flushPeriod -- period in which data flushes from memory buffer in milliseconds. 0 - turn off this functionality
+func NewBufferedWriter(innerWriter io.Writer, bufferSize int, flushPeriod time.Duration) (*bufferedWriter, error) {
+
+	if innerWriter == nil {
+		return nil, errors.New("argument is nil: innerWriter")
+	}
+	if flushPeriod < 0 {
+		return nil, fmt.Errorf("flushPeriod can not be less than 0. Got: %d", flushPeriod)
+	}
+
+	if bufferSize <= 0 {
+		return nil, fmt.Errorf("bufferSize can not be less or equal to 0. Got: %d", bufferSize)
+	}
+
+	buffer := bufio.NewWriterSize(innerWriter, bufferSize)
+
+	/*if err != nil {
+		return nil, err
+	}*/
+
+	newWriter := new(bufferedWriter)
+
+	newWriter.innerWriter = innerWriter
+	newWriter.buffer = buffer
+	newWriter.bufferSize = bufferSize
+	newWriter.flushPeriod = flushPeriod * 1e6
+	newWriter.bufferMutex = new(sync.Mutex)
+
+	if flushPeriod != 0 {
+		go newWriter.flushPeriodically()
+	}
+
+	return newWriter, nil
+}
+
+func (bufWriter *bufferedWriter) writeBigChunk(bytes []byte) (n int, err error) {
+	bufferedLen := bufWriter.buffer.Buffered()
+
+	n, err = bufWriter.flushInner()
+	if err != nil {
+		return
+	}
+
+	written, writeErr := bufWriter.innerWriter.Write(bytes)
+	return bufferedLen + written, writeErr
+}
+
+// Sends data to buffer manager. Waits until all buffers are full.
+func (bufWriter *bufferedWriter) Write(bytes []byte) (n int, err error) {
+
+	bufWriter.bufferMutex.Lock()
+	defer bufWriter.bufferMutex.Unlock()
+
+	bytesLen := len(bytes)
+
+	if bytesLen > bufWriter.bufferSize {
+		return bufWriter.writeBigChunk(bytes)
+	}
+
+	if bytesLen > bufWriter.buffer.Available() {
+		n, err = bufWriter.flushInner()
+		if err != nil {
+			return
+		}
+	}
+
+	bufWriter.buffer.Write(bytes)
+
+	return len(bytes), nil
+}
+
+func (bufWriter *bufferedWriter) Close() error {
+	closer, ok := bufWriter.innerWriter.(io.Closer)
+	if ok {
+		return closer.Close()
+	}
+
+	return nil
+}
+
+func (bufWriter *bufferedWriter) Flush() {
+
+	bufWriter.bufferMutex.Lock()
+	defer bufWriter.bufferMutex.Unlock()
+
+	bufWriter.flushInner()
+}
+
+func (bufWriter *bufferedWriter) flushInner() (n int, err error) {
+	bufferedLen := bufWriter.buffer.Buffered()
+	flushErr := bufWriter.buffer.Flush()
+
+	return bufWriter.buffer.Buffered() - bufferedLen, flushErr
+}
+
+func (bufWriter *bufferedWriter) flushBuffer() {
+	bufWriter.bufferMutex.Lock()
+	defer bufWriter.bufferMutex.Unlock()
+
+	bufWriter.buffer.Flush()
+}
+
+func (bufWriter *bufferedWriter) flushPeriodically() {
+	if bufWriter.flushPeriod > 0 {
+		ticker := time.NewTicker(bufWriter.flushPeriod)
+		for {
+			<-ticker.C
+			bufWriter.flushBuffer()
+		}
+	}
+}
+
+func (bufWriter *bufferedWriter) String() string {
+	return fmt.Sprintf("bufferedWriter size: %d, flushPeriod: %d", bufWriter.bufferSize, bufWriter.flushPeriod)
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/writers_connwriter.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/writers_connwriter.go
new file mode 100644
index 00000000..d199894e
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/writers_connwriter.go
@@ -0,0 +1,144 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"crypto/tls"
+	"fmt"
+	"io"
+	"net"
+)
+
+// connWriter is used to write to a stream-oriented network connection.
+type connWriter struct {
+	innerWriter    io.WriteCloser
+	reconnectOnMsg bool
+	reconnect      bool
+	net            string
+	addr           string
+	useTLS         bool
+	configTLS      *tls.Config
+}
+
+// Creates writer to the address addr on the network netName.
+// Connection will be opened on each write if reconnectOnMsg = true
+func NewConnWriter(netName string, addr string, reconnectOnMsg bool) *connWriter {
+	newWriter := new(connWriter)
+
+	newWriter.net = netName
+	newWriter.addr = addr
+	newWriter.reconnectOnMsg = reconnectOnMsg
+
+	return newWriter
+}
+
+// Creates a writer that uses SSL/TLS
+func newTLSWriter(netName string, addr string, reconnectOnMsg bool, config *tls.Config) *connWriter {
+	newWriter := new(connWriter)
+
+	newWriter.net = netName
+	newWriter.addr = addr
+	newWriter.reconnectOnMsg = reconnectOnMsg
+	newWriter.useTLS = true
+	newWriter.configTLS = config
+
+	return newWriter
+}
+
+func (connWriter *connWriter) Close() error {
+	if connWriter.innerWriter == nil {
+		return nil
+	}
+
+	return connWriter.innerWriter.Close()
+}
+
+func (connWriter *connWriter) Write(bytes []byte) (n int, err error) {
+	if connWriter.neededConnectOnMsg() {
+		err = connWriter.connect()
+		if err != nil {
+			return 0, err
+		}
+	}
+
+	if connWriter.reconnectOnMsg {
+		defer connWriter.innerWriter.Close()
+	}
+
+	n, err = connWriter.innerWriter.Write(bytes)
+	if err != nil {
+		connWriter.reconnect = true
+	}
+
+	return
+}
+
+func (connWriter *connWriter) String() string {
+	return fmt.Sprintf("Conn writer: [%s, %s, %v]", connWriter.net, connWriter.addr, connWriter.reconnectOnMsg)
+}
+
+func (connWriter *connWriter) connect() error {
+	if connWriter.innerWriter != nil {
+		connWriter.innerWriter.Close()
+		connWriter.innerWriter = nil
+	}
+
+	if connWriter.useTLS {
+		conn, err := tls.Dial(connWriter.net, connWriter.addr, connWriter.configTLS)
+		if err != nil {
+			return err
+		}
+		connWriter.innerWriter = conn
+
+		return nil
+	}
+
+	conn, err := net.Dial(connWriter.net, connWriter.addr)
+	if err != nil {
+		return err
+	}
+
+	tcpConn, ok := conn.(*net.TCPConn)
+	if ok {
+		tcpConn.SetKeepAlive(true)
+	}
+
+	connWriter.innerWriter = conn
+
+	return nil
+}
+
+func (connWriter *connWriter) neededConnectOnMsg() bool {
+	if connWriter.reconnect {
+		connWriter.reconnect = false
+		return true
+	}
+
+	if connWriter.innerWriter == nil {
+		return true
+	}
+
+	return connWriter.reconnectOnMsg
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/writers_consolewriter.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/writers_consolewriter.go
new file mode 100644
index 00000000..3eb79afa
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/writers_consolewriter.go
@@ -0,0 +1,47 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import "fmt"
+
+// consoleWriter is used to write to console
+type consoleWriter struct {
+}
+
+// Creates a new console writer. Returns error, if the console writer couldn't be created.
+func NewConsoleWriter() (writer *consoleWriter, err error) {
+	newWriter := new(consoleWriter)
+
+	return newWriter, nil
+}
+
+// Create folder and file on WriteLog/Write first call
+func (console *consoleWriter) Write(bytes []byte) (int, error) {
+	return fmt.Print(string(bytes))
+}
+
+func (console *consoleWriter) String() string {
+	return "Console writer"
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/writers_filewriter.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/writers_filewriter.go
new file mode 100644
index 00000000..8d3ae270
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/writers_filewriter.go
@@ -0,0 +1,92 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+)
+
+// fileWriter is used to write to a file.
+type fileWriter struct {
+	innerWriter io.WriteCloser
+	fileName    string
+}
+
+// Creates a new file and a corresponding writer. Returns error, if the file couldn't be created.
+func NewFileWriter(fileName string) (writer *fileWriter, err error) {
+	newWriter := new(fileWriter)
+	newWriter.fileName = fileName
+
+	return newWriter, nil
+}
+
+func (fw *fileWriter) Close() error {
+	if fw.innerWriter != nil {
+		err := fw.innerWriter.Close()
+		if err != nil {
+			return err
+		}
+		fw.innerWriter = nil
+	}
+	return nil
+}
+
+// Create folder and file on WriteLog/Write first call
+func (fw *fileWriter) Write(bytes []byte) (n int, err error) {
+	if fw.innerWriter == nil {
+		if err := fw.createFile(); err != nil {
+			return 0, err
+		}
+	}
+	return fw.innerWriter.Write(bytes)
+}
+
+func (fw *fileWriter) createFile() error {
+	folder, _ := filepath.Split(fw.fileName)
+	var err error
+
+	if 0 != len(folder) {
+		err = os.MkdirAll(folder, defaultDirectoryPermissions)
+		if err != nil {
+			return err
+		}
+	}
+
+	// If exists
+	fw.innerWriter, err = os.OpenFile(fw.fileName, os.O_WRONLY|os.O_APPEND|os.O_CREATE, defaultFilePermissions)
+
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (fw *fileWriter) String() string {
+	return fmt.Sprintf("File writer: %s", fw.fileName)
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/writers_formattedwriter.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/writers_formattedwriter.go
new file mode 100644
index 00000000..bf44a410
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/writers_formattedwriter.go
@@ -0,0 +1,62 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"errors"
+	"fmt"
+	"io"
+)
+
+type formattedWriter struct {
+	writer    io.Writer
+	formatter *formatter
+}
+
+func NewFormattedWriter(writer io.Writer, formatter *formatter) (*formattedWriter, error) {
+	if formatter == nil {
+		return nil, errors.New("formatter can not be nil")
+	}
+
+	return &formattedWriter{writer, formatter}, nil
+}
+
+func (formattedWriter *formattedWriter) Write(message string, level LogLevel, context LogContextInterface) error {
+	str := formattedWriter.formatter.Format(message, level, context)
+	_, err := formattedWriter.writer.Write([]byte(str))
+	return err
+}
+
+func (formattedWriter *formattedWriter) String() string {
+	return fmt.Sprintf("writer: %s, format: %s", formattedWriter.writer, formattedWriter.formatter)
+}
+
+func (formattedWriter *formattedWriter) Writer() io.Writer {
+	return formattedWriter.writer
+}
+
+func (formattedWriter *formattedWriter) Format() *formatter {
+	return formattedWriter.formatter
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/writers_rollingfilewriter.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/writers_rollingfilewriter.go
new file mode 100644
index 00000000..2422a67c
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/writers_rollingfilewriter.go
@@ -0,0 +1,625 @@
+// Copyright (c) 2013 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// Common constants
+const (
+	rollingLogHistoryDelimiter = "."
+)
+
+// Types of the rolling writer: roll by date, by time, etc.
+type rollingType uint8
+
+const (
+	rollingTypeSize = iota
+	rollingTypeTime
+)
+
+// Types of the rolled file naming mode: prefix, postfix, etc.
+type rollingNameMode uint8
+
+const (
+	rollingNameModePostfix = iota
+	rollingNameModePrefix
+)
+
+var rollingNameModesStringRepresentation = map[rollingNameMode]string{
+	rollingNameModePostfix: "postfix",
+	rollingNameModePrefix:  "prefix",
+}
+
+func rollingNameModeFromString(rollingNameStr string) (rollingNameMode, bool) {
+	for tp, tpStr := range rollingNameModesStringRepresentation {
+		if tpStr == rollingNameStr {
+			return tp, true
+		}
+	}
+
+	return 0, false
+}
+
+type rollingIntervalType uint8
+
+const (
+	rollingIntervalAny = iota
+	rollingIntervalDaily
+)
+
+var rollingInvervalTypesStringRepresentation = map[rollingIntervalType]string{
+	rollingIntervalDaily: "daily",
+}
+
+func rollingIntervalTypeFromString(rollingTypeStr string) (rollingIntervalType, bool) {
+	for tp, tpStr := range rollingInvervalTypesStringRepresentation {
+		if tpStr == rollingTypeStr {
+			return tp, true
+		}
+	}
+
+	return 0, false
+}
+
+var rollingTypesStringRepresentation = map[rollingType]string{
+	rollingTypeSize: "size",
+	rollingTypeTime: "date",
+}
+
+func rollingTypeFromString(rollingTypeStr string) (rollingType, bool) {
+	for tp, tpStr := range rollingTypesStringRepresentation {
+		if tpStr == rollingTypeStr {
+			return tp, true
+		}
+	}
+
+	return 0, false
+}
+
+// Old logs archivation type.
+type rollingArchiveType uint8
+
+const (
+	rollingArchiveNone = iota
+	rollingArchiveZip
+)
+
+var rollingArchiveTypesStringRepresentation = map[rollingArchiveType]string{
+	rollingArchiveNone: "none",
+	rollingArchiveZip:  "zip",
+}
+
+func rollingArchiveTypeFromString(rollingArchiveTypeStr string) (rollingArchiveType, bool) {
+	for tp, tpStr := range rollingArchiveTypesStringRepresentation {
+		if tpStr == rollingArchiveTypeStr {
+			return tp, true
+		}
+	}
+
+	return 0, false
+}
+
+// Default names for different archivation types
+var rollingArchiveTypesDefaultNames = map[rollingArchiveType]string{
+	rollingArchiveZip: "log.zip",
+}
+
+// rollerVirtual is an interface that represents all virtual funcs that are
+// called in different rolling writer subtypes.
+type rollerVirtual interface {
+	needsToRoll() (bool, error)                         // Returns true if needs to switch to another file.
+	isFileRollNameValid(rname string) bool              // Returns true if logger roll file name (postfix/prefix/etc.) is ok.
+	sortFileRollNamesAsc(fs []string) ([]string, error) // Sorts logger roll file names in ascending order of their creation by logger.
+
+	// Creates a new froll history file using the contents of current file and special filename of the latest roll (prefix/ postfix).
+	// If lastRollName is empty (""), then it means that there is no latest roll (current is the first one)
+	getNewHistoryRollFileName(lastRollName string) string
+	getCurrentModifiedFileName(originalFileName string, first bool) (string, error) // Returns filename modified according to specific logger rules
+}
+
+// rollingFileWriter writes received messages to a file, until time interval passes
+// or file exceeds a specified limit. After that the current log file is renamed
+// and writer starts to log into a new file. You can set a limit for such renamed
+// files count, if you want, and then the rolling writer would delete older ones when
+// the files count exceed the specified limit.
+type rollingFileWriter struct {
+	fileName         string // current file name. May differ from original in date rolling loggers
+	originalFileName string // original one
+	currentDirPath   string
+	currentFile      *os.File
+	currentFileSize  int64
+	rollingType      rollingType // Rolling mode (Files roll by size/date/...)
+	archiveType      rollingArchiveType
+	archivePath      string
+	maxRolls         int
+	nameMode         rollingNameMode
+	self             rollerVirtual // Used for virtual calls
+}
+
+func newRollingFileWriter(fpath string, rtype rollingType, atype rollingArchiveType, apath string, maxr int, namemode rollingNameMode) (*rollingFileWriter, error) {
+	rw := new(rollingFileWriter)
+	rw.currentDirPath, rw.fileName = filepath.Split(fpath)
+	if len(rw.currentDirPath) == 0 {
+		rw.currentDirPath = "."
+	}
+	rw.originalFileName = rw.fileName
+
+	rw.rollingType = rtype
+	rw.archiveType = atype
+	rw.archivePath = apath
+	rw.nameMode = namemode
+	rw.maxRolls = maxr
+	return rw, nil
+}
+
+func (rw *rollingFileWriter) hasRollName(file string) bool {
+	switch rw.nameMode {
+	case rollingNameModePostfix:
+		rname := rw.originalFileName + rollingLogHistoryDelimiter
+		return strings.HasPrefix(file, rname)
+	case rollingNameModePrefix:
+		rname := rollingLogHistoryDelimiter + rw.originalFileName
+		return strings.HasSuffix(file, rname)
+	}
+	return false
+}
+
+func (rw *rollingFileWriter) createFullFileName(originalName, rollname string) string {
+	switch rw.nameMode {
+	case rollingNameModePostfix:
+		return originalName + rollingLogHistoryDelimiter + rollname
+	case rollingNameModePrefix:
+		return rollname + rollingLogHistoryDelimiter + originalName
+	}
+	return ""
+}
+
+func (rw *rollingFileWriter) getSortedLogHistory() ([]string, error) {
+	files, err := getDirFilePaths(rw.currentDirPath, nil, true)
+	if err != nil {
+		return nil, err
+	}
+	var validRollNames []string
+	for _, file := range files {
+		if file != rw.fileName && rw.hasRollName(file) {
+			rname := rw.getFileRollName(file)
+			if rw.self.isFileRollNameValid(rname) {
+				validRollNames = append(validRollNames, rname)
+			}
+		}
+	}
+	sortedTails, err := rw.self.sortFileRollNamesAsc(validRollNames)
+	if err != nil {
+		return nil, err
+	}
+	validSortedFiles := make([]string, len(sortedTails))
+	for i, v := range sortedTails {
+		validSortedFiles[i] = rw.createFullFileName(rw.originalFileName, v)
+	}
+	return validSortedFiles, nil
+}
+
+func (rw *rollingFileWriter) createFileAndFolderIfNeeded(first bool) error {
+	var err error
+
+	if len(rw.currentDirPath) != 0 {
+		err = os.MkdirAll(rw.currentDirPath, defaultDirectoryPermissions)
+
+		if err != nil {
+			return err
+		}
+	}
+
+	rw.fileName, err = rw.self.getCurrentModifiedFileName(rw.originalFileName, first)
+	if err != nil {
+		return err
+	}
+	filePath := filepath.Join(rw.currentDirPath, rw.fileName)
+
+	// If exists
+	stat, err := os.Lstat(filePath)
+	if err == nil {
+		rw.currentFile, err = os.OpenFile(filePath, os.O_WRONLY|os.O_APPEND, defaultFilePermissions)
+
+		stat, err = os.Lstat(filePath)
+		if err != nil {
+			return err
+		}
+
+		rw.currentFileSize = stat.Size()
+	} else {
+		rw.currentFile, err = os.Create(filePath)
+		rw.currentFileSize = 0
+	}
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (rw *rollingFileWriter) deleteOldRolls(history []string) error {
+	if rw.maxRolls <= 0 {
+		return nil
+	}
+
+	rollsToDelete := len(history) - rw.maxRolls
+	if rollsToDelete <= 0 {
+		return nil
+	}
+
+	switch rw.archiveType {
+	case rollingArchiveZip:
+		var files map[string][]byte
+
+		// If archive exists
+		_, err := os.Lstat(rw.archivePath)
+		if nil == err {
+			// Extract files and content from it
+			files, err = unzip(rw.archivePath)
+			if err != nil {
+				return err
+			}
+
+			// Remove the original file
+			err = tryRemoveFile(rw.archivePath)
+			if err != nil {
+				return err
+			}
+		} else {
+			files = make(map[string][]byte)
+		}
+
+		// Add files to the existing files map, filled above
+		for i := 0; i < rollsToDelete; i++ {
+			rollPath := filepath.Join(rw.currentDirPath, history[i])
+			bts, err := ioutil.ReadFile(rollPath)
+			if err != nil {
+				return err
+			}
+
+			files[rollPath] = bts
+		}
+
+		// Put the final file set to zip file.
+		if err = createZip(rw.archivePath, files); err != nil {
+			return err
+		}
+	}
+	var err error
+	// In all cases (archive files or not) the files should be deleted.
+	for i := 0; i < rollsToDelete; i++ {
+		// Try best to delete files without breaking the loop.
+		if err = tryRemoveFile(filepath.Join(rw.currentDirPath, history[i])); err != nil {
+			reportInternalError(err)
+		}
+	}
+
+	return nil
+}
+
+func (rw *rollingFileWriter) getFileRollName(fileName string) string {
+	switch rw.nameMode {
+	case rollingNameModePostfix:
+		return fileName[len(rw.originalFileName+rollingLogHistoryDelimiter):]
+	case rollingNameModePrefix:
+		return fileName[:len(fileName)-len(rw.originalFileName+rollingLogHistoryDelimiter)]
+	}
+	return ""
+}
+
+func (rw *rollingFileWriter) Write(bytes []byte) (n int, err error) {
+	if rw.currentFile == nil {
+		err := rw.createFileAndFolderIfNeeded(true)
+		if err != nil {
+			return 0, err
+		}
+	}
+	// needs to roll if:
+	//   * file roller max file size exceeded OR
+	//   * time roller interval passed
+	nr, err := rw.self.needsToRoll()
+	if err != nil {
+		return 0, err
+	}
+	if nr {
+		// First, close current file.
+		err = rw.currentFile.Close()
+		if err != nil {
+			return 0, err
+		}
+		// Current history of all previous log files.
+		// For file roller it may be like this:
+		//     * ...
+		//     * file.log.4
+		//     * file.log.5
+		//     * file.log.6
+		//
+		// For date roller it may look like this:
+		//     * ...
+		//     * file.log.11.Aug.13
+		//     * file.log.15.Aug.13
+		//     * file.log.16.Aug.13
+		// Sorted log history does NOT include current file.
+		history, err := rw.getSortedLogHistory()
+		if err != nil {
+			return 0, err
+		}
+		// Renames current file to create a new roll history entry
+		// For file roller it may be like this:
+		//     * ...
+		//     * file.log.4
+		//     * file.log.5
+		//     * file.log.6
+		//     n file.log.7  <---- RENAMED (from file.log)
+		// Time rollers that doesn't modify file names (e.g. 'date' roller) skip this logic.
+		var newHistoryName string
+		var newRollMarkerName string
+		if len(history) > 0 {
+			// Create new rname name using last history file name
+			newRollMarkerName = rw.self.getNewHistoryRollFileName(rw.getFileRollName(history[len(history)-1]))
+		} else {
+			// Create first rname name
+			newRollMarkerName = rw.self.getNewHistoryRollFileName("")
+		}
+		if len(newRollMarkerName) != 0 {
+			newHistoryName = rw.createFullFileName(rw.fileName, newRollMarkerName)
+		} else {
+			newHistoryName = rw.fileName
+		}
+		if newHistoryName != rw.fileName {
+			err = os.Rename(filepath.Join(rw.currentDirPath, rw.fileName), filepath.Join(rw.currentDirPath, newHistoryName))
+			if err != nil {
+				return 0, err
+			}
+		}
+		// Finally, add the newly added history file to the history archive
+		// and, if after that the archive exceeds the allowed max limit, older rolls
+		// must the removed/archived.
+		history = append(history, newHistoryName)
+		if len(history) > rw.maxRolls {
+			err = rw.deleteOldRolls(history)
+			if err != nil {
+				return 0, err
+			}
+		}
+
+		err = rw.createFileAndFolderIfNeeded(false)
+		if err != nil {
+			return 0, err
+		}
+	}
+
+	rw.currentFileSize += int64(len(bytes))
+	return rw.currentFile.Write(bytes)
+}
+
+func (rw *rollingFileWriter) Close() error {
+	if rw.currentFile != nil {
+		e := rw.currentFile.Close()
+		if e != nil {
+			return e
+		}
+		rw.currentFile = nil
+	}
+	return nil
+}
+
+// =============================================================================================
+//      Different types of rolling writers
+// =============================================================================================
+
+// --------------------------------------------------
+//      Rolling writer by SIZE
+// --------------------------------------------------
+
+// rollingFileWriterSize performs roll when file exceeds a specified limit.
+type rollingFileWriterSize struct {
+	*rollingFileWriter
+	maxFileSize int64
+}
+
+func NewRollingFileWriterSize(fpath string, atype rollingArchiveType, apath string, maxSize int64, maxRolls int, namemode rollingNameMode) (*rollingFileWriterSize, error) {
+	rw, err := newRollingFileWriter(fpath, rollingTypeSize, atype, apath, maxRolls, namemode)
+	if err != nil {
+		return nil, err
+	}
+	rws := &rollingFileWriterSize{rw, maxSize}
+	rws.self = rws
+	return rws, nil
+}
+
+func (rws *rollingFileWriterSize) needsToRoll() (bool, error) {
+	return rws.currentFileSize >= rws.maxFileSize, nil
+}
+
+func (rws *rollingFileWriterSize) isFileRollNameValid(rname string) bool {
+	if len(rname) == 0 {
+		return false
+	}
+	_, err := strconv.Atoi(rname)
+	return err == nil
+}
+
+type rollSizeFileTailsSlice []string
+
+func (p rollSizeFileTailsSlice) Len() int { return len(p) }
+func (p rollSizeFileTailsSlice) Less(i, j int) bool {
+	v1, _ := strconv.Atoi(p[i])
+	v2, _ := strconv.Atoi(p[j])
+	return v1 < v2
+}
+func (p rollSizeFileTailsSlice) Swap(i, j int) { p[i], p[j] = p[j], p[i] }
+
+func (rws *rollingFileWriterSize) sortFileRollNamesAsc(fs []string) ([]string, error) {
+	ss := rollSizeFileTailsSlice(fs)
+	sort.Sort(ss)
+	return ss, nil
+}
+
+func (rws *rollingFileWriterSize) getNewHistoryRollFileName(lastRollName string) string {
+	v := 0
+	if len(lastRollName) != 0 {
+		v, _ = strconv.Atoi(lastRollName)
+	}
+	return fmt.Sprintf("%d", v+1)
+}
+
+func (rws *rollingFileWriterSize) getCurrentModifiedFileName(originalFileName string, first bool) (string, error) {
+	return originalFileName, nil
+}
+
+func (rws *rollingFileWriterSize) String() string {
+	return fmt.Sprintf("Rolling file writer (By SIZE): filename: %s, archive: %s, archivefile: %s, maxFileSize: %v, maxRolls: %v",
+		rws.fileName,
+		rollingArchiveTypesStringRepresentation[rws.archiveType],
+		rws.archivePath,
+		rws.maxFileSize,
+		rws.maxRolls)
+}
+
+// --------------------------------------------------
+//      Rolling writer by TIME
+// --------------------------------------------------
+
+// rollingFileWriterTime performs roll when a specified time interval has passed.
+type rollingFileWriterTime struct {
+	*rollingFileWriter
+	timePattern         string
+	interval            rollingIntervalType
+	currentTimeFileName string
+}
+
+func NewRollingFileWriterTime(fpath string, atype rollingArchiveType, apath string, maxr int,
+	timePattern string, interval rollingIntervalType, namemode rollingNameMode) (*rollingFileWriterTime, error) {
+
+	rw, err := newRollingFileWriter(fpath, rollingTypeTime, atype, apath, maxr, namemode)
+	if err != nil {
+		return nil, err
+	}
+	rws := &rollingFileWriterTime{rw, timePattern, interval, ""}
+	rws.self = rws
+	return rws, nil
+}
+
+func (rwt *rollingFileWriterTime) needsToRoll() (bool, error) {
+	switch rwt.nameMode {
+	case rollingNameModePostfix:
+		if rwt.originalFileName+rollingLogHistoryDelimiter+time.Now().Format(rwt.timePattern) == rwt.fileName {
+			return false, nil
+		}
+	case rollingNameModePrefix:
+		if time.Now().Format(rwt.timePattern)+rollingLogHistoryDelimiter+rwt.originalFileName == rwt.fileName {
+			return false, nil
+		}
+	}
+	if rwt.interval == rollingIntervalAny {
+		return true, nil
+	}
+
+	tprev, err := time.ParseInLocation(rwt.timePattern, rwt.getFileRollName(rwt.fileName), time.Local)
+	if err != nil {
+		return false, err
+	}
+
+	diff := time.Now().Sub(tprev)
+	switch rwt.interval {
+	case rollingIntervalDaily:
+		return diff >= 24*time.Hour, nil
+	}
+	return false, fmt.Errorf("unknown interval type: %d", rwt.interval)
+}
+
+func (rwt *rollingFileWriterTime) isFileRollNameValid(rname string) bool {
+	if len(rname) == 0 {
+		return false
+	}
+	_, err := time.ParseInLocation(rwt.timePattern, rname, time.Local)
+	return err == nil
+}
+
+type rollTimeFileTailsSlice struct {
+	data    []string
+	pattern string
+}
+
+func (p rollTimeFileTailsSlice) Len() int { return len(p.data) }
+
+func (p rollTimeFileTailsSlice) Less(i, j int) bool {
+	t1, _ := time.ParseInLocation(p.pattern, p.data[i], time.Local)
+	t2, _ := time.ParseInLocation(p.pattern, p.data[j], time.Local)
+	return t1.Before(t2)
+}
+
+func (p rollTimeFileTailsSlice) Swap(i, j int) { p.data[i], p.data[j] = p.data[j], p.data[i] }
+
+func (rwt *rollingFileWriterTime) sortFileRollNamesAsc(fs []string) ([]string, error) {
+	ss := rollTimeFileTailsSlice{data: fs, pattern: rwt.timePattern}
+	sort.Sort(ss)
+	return ss.data, nil
+}
+
+func (rwt *rollingFileWriterTime) getNewHistoryRollFileName(lastRollName string) string {
+	return ""
+}
+
+func (rwt *rollingFileWriterTime) getCurrentModifiedFileName(originalFileName string, first bool) (string, error) {
+	if first {
+		history, err := rwt.getSortedLogHistory()
+		if err != nil {
+			return "", err
+		}
+		if len(history) > 0 {
+			return history[len(history)-1], nil
+		}
+	}
+
+	switch rwt.nameMode {
+	case rollingNameModePostfix:
+		return originalFileName + rollingLogHistoryDelimiter + time.Now().Format(rwt.timePattern), nil
+	case rollingNameModePrefix:
+		return time.Now().Format(rwt.timePattern) + rollingLogHistoryDelimiter + originalFileName, nil
+	}
+	return "", fmt.Errorf("Unknown rolling writer mode. Either postfix or prefix must be used")
+}
+
+func (rwt *rollingFileWriterTime) String() string {
+	return fmt.Sprintf("Rolling file writer (By TIME): filename: %s, archive: %s, archivefile: %s, maxInterval: %v, pattern: %s, maxRolls: %v",
+		rwt.fileName,
+		rollingArchiveTypesStringRepresentation[rwt.archiveType],
+		rwt.archivePath,
+		rwt.interval,
+		rwt.timePattern,
+		rwt.maxRolls)
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/writers_smtpwriter.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/writers_smtpwriter.go
new file mode 100644
index 00000000..31b79438
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/cihub/seelog/writers_smtpwriter.go
@@ -0,0 +1,214 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"net/smtp"
+	"path/filepath"
+	"strings"
+)
+
+const (
+	// Default subject phrase for sending emails.
+	DefaultSubjectPhrase = "Diagnostic message from server: "
+
+	// Message subject pattern composed according to RFC 5321.
+	rfc5321SubjectPattern = "From: %s <%s>\nSubject: %s\n\n"
+)
+
+// smtpWriter is used to send emails via given SMTP-server.
+type smtpWriter struct {
+	auth               smtp.Auth
+	hostName           string
+	hostPort           string
+	hostNameWithPort   string
+	senderAddress      string
+	senderName         string
+	recipientAddresses []string
+	caCertDirPaths     []string
+	mailHeaders        []string
+	subject            string
+}
+
+// NewSMTPWriter returns a new SMTP-writer.
+func NewSMTPWriter(sa, sn string, ras []string, hn, hp, un, pwd string, cacdps []string, subj string, headers []string) *smtpWriter {
+	return &smtpWriter{
+		auth:               smtp.PlainAuth("", un, pwd, hn),
+		hostName:           hn,
+		hostPort:           hp,
+		hostNameWithPort:   fmt.Sprintf("%s:%s", hn, hp),
+		senderAddress:      sa,
+		senderName:         sn,
+		recipientAddresses: ras,
+		caCertDirPaths:     cacdps,
+		subject:            subj,
+		mailHeaders:        headers,
+	}
+}
+
+func prepareMessage(senderAddr, senderName, subject string, body []byte, headers []string) []byte {
+	headerLines := fmt.Sprintf(rfc5321SubjectPattern, senderName, senderAddr, subject)
+	// Build header lines if configured.
+	if headers != nil && len(headers) > 0 {
+		headerLines += strings.Join(headers, "\n")
+		headerLines += "\n"
+	}
+	return append([]byte(headerLines), body...)
+}
+
+// getTLSConfig gets paths of PEM files with certificates,
+// host server name and tries to create an appropriate TLS.Config.
+func getTLSConfig(pemFileDirPaths []string, hostName string) (config *tls.Config, err error) {
+	if pemFileDirPaths == nil || len(pemFileDirPaths) == 0 {
+		err = errors.New("invalid PEM file paths")
+		return
+	}
+	pemEncodedContent := []byte{}
+	var (
+		e     error
+		bytes []byte
+	)
+	// Create a file-filter-by-extension, set aside non-pem files.
+	pemFilePathFilter := func(fp string) bool {
+		if filepath.Ext(fp) == ".pem" {
+			return true
+		}
+		return false
+	}
+	for _, pemFileDirPath := range pemFileDirPaths {
+		pemFilePaths, err := getDirFilePaths(pemFileDirPath, pemFilePathFilter, false)
+		if err != nil {
+			return nil, err
+		}
+
+		// Put together all the PEM files to decode them as a whole byte slice.
+		for _, pfp := range pemFilePaths {
+			if bytes, e = ioutil.ReadFile(pfp); e == nil {
+				pemEncodedContent = append(pemEncodedContent, bytes...)
+			} else {
+				return nil, fmt.Errorf("cannot read file: %s: %s", pfp, e.Error())
+			}
+		}
+	}
+	config = &tls.Config{RootCAs: x509.NewCertPool(), ServerName: hostName}
+	isAppended := config.RootCAs.AppendCertsFromPEM(pemEncodedContent)
+	if !isAppended {
+		// Extract this into a separate error.
+		err = errors.New("invalid PEM content")
+		return
+	}
+	return
+}
+
+// SendMail accepts TLS configuration, connects to the server at addr,
+// switches to TLS if possible, authenticates with mechanism a if possible,
+// and then sends an email from address from, to addresses to, with message msg.
+func sendMailWithTLSConfig(config *tls.Config, addr string, a smtp.Auth, from string, to []string, msg []byte) error {
+	c, err := smtp.Dial(addr)
+	if err != nil {
+		return err
+	}
+	// Check if the server supports STARTTLS extension.
+	if ok, _ := c.Extension("STARTTLS"); ok {
+		if err = c.StartTLS(config); err != nil {
+			return err
+		}
+	}
+	// Check if the server supports AUTH extension and use given smtp.Auth.
+	if a != nil {
+		if isSupported, _ := c.Extension("AUTH"); isSupported {
+			if err = c.Auth(a); err != nil {
+				return err
+			}
+		}
+	}
+	// Portion of code from the official smtp.SendMail function,
+	// see http://golang.org/src/pkg/net/smtp/smtp.go.
+	if err = c.Mail(from); err != nil {
+		return err
+	}
+	for _, addr := range to {
+		if err = c.Rcpt(addr); err != nil {
+			return err
+		}
+	}
+	w, err := c.Data()
+	if err != nil {
+		return err
+	}
+	_, err = w.Write(msg)
+	if err != nil {
+		return err
+	}
+	err = w.Close()
+	if err != nil {
+		return err
+	}
+	return c.Quit()
+}
+
+// Write pushes a text message properly composed according to RFC 5321
+// to a post server, which sends it to the recipients.
+func (smtpw *smtpWriter) Write(data []byte) (int, error) {
+	var err error
+
+	if smtpw.caCertDirPaths == nil {
+		err = smtp.SendMail(
+			smtpw.hostNameWithPort,
+			smtpw.auth,
+			smtpw.senderAddress,
+			smtpw.recipientAddresses,
+			prepareMessage(smtpw.senderAddress, smtpw.senderName, smtpw.subject, data, smtpw.mailHeaders),
+		)
+	} else {
+		config, e := getTLSConfig(smtpw.caCertDirPaths, smtpw.hostName)
+		if e != nil {
+			return 0, e
+		}
+		err = sendMailWithTLSConfig(
+			config,
+			smtpw.hostNameWithPort,
+			smtpw.auth,
+			smtpw.senderAddress,
+			smtpw.recipientAddresses,
+			prepareMessage(smtpw.senderAddress, smtpw.senderName, smtpw.subject, data, smtpw.mailHeaders),
+		)
+	}
+	if err != nil {
+		return 0, err
+	}
+	return len(data), nil
+}
+
+// Close closes down SMTP-connection.
+func (smtpw *smtpWriter) Close() error {
+	// Do nothing as Write method opens and closes connection automatically.
+	return nil
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/.gitignore b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/.gitignore
new file mode 100644
index 00000000..5091fb07
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/.gitignore
@@ -0,0 +1,4 @@
+/jpgo
+jmespath-fuzz.zip
+cpu.out
+go-jmespath.test
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/.travis.yml b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/.travis.yml
new file mode 100644
index 00000000..1f980775
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/.travis.yml
@@ -0,0 +1,9 @@
+language: go
+
+sudo: false
+
+go:
+  - 1.4
+
+install: go get -v -t ./...
+script: make test
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/LICENSE b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/LICENSE
new file mode 100644
index 00000000..b03310a9
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/LICENSE
@@ -0,0 +1,13 @@
+Copyright 2015 James Saryerwinnie
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/Makefile b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/Makefile
new file mode 100644
index 00000000..a828d284
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/Makefile
@@ -0,0 +1,44 @@
+
+CMD = jpgo
+
+help:
+	@echo "Please use \`make <target>' where <target> is one of"
+	@echo "  test                    to run all the tests"
+	@echo "  build                   to build the library and jp executable"
+	@echo "  generate                to run codegen"
+
+
+generate:
+	go generate ./...
+
+build:
+	rm -f $(CMD)
+	go build ./...
+	rm -f cmd/$(CMD)/$(CMD) && cd cmd/$(CMD)/ && go build ./...
+	mv cmd/$(CMD)/$(CMD) .
+
+test:
+	go test -v ./...
+
+check:
+	go vet ./...
+	@echo "golint ./..."
+	@lint=`golint ./...`; \
+	lint=`echo "$$lint" | grep -v "astnodetype_string.go" | grep -v "toktype_string.go"`; \
+	echo "$$lint"; \
+	if [ "$$lint" != "" ]; then exit 1; fi
+
+htmlc:
+	go test -coverprofile="/tmp/jpcov"  && go tool cover -html="/tmp/jpcov" && unlink /tmp/jpcov
+
+buildfuzz:
+	go-fuzz-build github.com/jmespath/go-jmespath/fuzz
+
+fuzz: buildfuzz
+	go-fuzz -bin=./jmespath-fuzz.zip -workdir=fuzz/testdata
+
+bench:
+	go test -bench . -cpuprofile cpu.out
+
+pprof-cpu:
+	go tool pprof ./go-jmespath.test ./cpu.out
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/README.md b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/README.md
new file mode 100644
index 00000000..187ef676
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/README.md
@@ -0,0 +1,7 @@
+# go-jmespath - A JMESPath implementation in Go
+
+[![Build Status](https://img.shields.io/travis/jmespath/go-jmespath.svg)](https://travis-ci.org/jmespath/go-jmespath)
+
+
+
+See http://jmespath.org for more info.
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/api.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/api.go
new file mode 100644
index 00000000..8e26ffee
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/api.go
@@ -0,0 +1,49 @@
+package jmespath
+
+import "strconv"
+
+// JMESPath is the epresentation of a compiled JMES path query. A JMESPath is
+// safe for concurrent use by multiple goroutines.
+type JMESPath struct {
+	ast  ASTNode
+	intr *treeInterpreter
+}
+
+// Compile parses a JMESPath expression and returns, if successful, a JMESPath
+// object that can be used to match against data.
+func Compile(expression string) (*JMESPath, error) {
+	parser := NewParser()
+	ast, err := parser.Parse(expression)
+	if err != nil {
+		return nil, err
+	}
+	jmespath := &JMESPath{ast: ast, intr: newInterpreter()}
+	return jmespath, nil
+}
+
+// MustCompile is like Compile but panics if the expression cannot be parsed.
+// It simplifies safe initialization of global variables holding compiled
+// JMESPaths.
+func MustCompile(expression string) *JMESPath {
+	jmespath, err := Compile(expression)
+	if err != nil {
+		panic(`jmespath: Compile(` + strconv.Quote(expression) + `): ` + err.Error())
+	}
+	return jmespath
+}
+
+// Search evaluates a JMESPath expression against input data and returns the result.
+func (jp *JMESPath) Search(data interface{}) (interface{}, error) {
+	return jp.intr.Execute(jp.ast, data)
+}
+
+// Search evaluates a JMESPath expression against input data and returns the result.
+func Search(expression string, data interface{}) (interface{}, error) {
+	intr := newInterpreter()
+	parser := NewParser()
+	ast, err := parser.Parse(expression)
+	if err != nil {
+		return nil, err
+	}
+	return intr.Execute(ast, data)
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/astnodetype_string.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/astnodetype_string.go
new file mode 100644
index 00000000..1cd2d239
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/astnodetype_string.go
@@ -0,0 +1,16 @@
+// generated by stringer -type astNodeType; DO NOT EDIT
+
+package jmespath
+
+import "fmt"
+
+const _astNodeType_name = "ASTEmptyASTComparatorASTCurrentNodeASTExpRefASTFunctionExpressionASTFieldASTFilterProjectionASTFlattenASTIdentityASTIndexASTIndexExpressionASTKeyValPairASTLiteralASTMultiSelectHashASTMultiSelectListASTOrExpressionASTAndExpressionASTNotExpressionASTPipeASTProjectionASTSubexpressionASTSliceASTValueProjection"
+
+var _astNodeType_index = [...]uint16{0, 8, 21, 35, 44, 65, 73, 92, 102, 113, 121, 139, 152, 162, 180, 198, 213, 229, 245, 252, 265, 281, 289, 307}
+
+func (i astNodeType) String() string {
+	if i < 0 || i >= astNodeType(len(_astNodeType_index)-1) {
+		return fmt.Sprintf("astNodeType(%d)", i)
+	}
+	return _astNodeType_name[_astNodeType_index[i]:_astNodeType_index[i+1]]
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/functions.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/functions.go
new file mode 100644
index 00000000..9b7cd89b
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/functions.go
@@ -0,0 +1,842 @@
+package jmespath
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"math"
+	"reflect"
+	"sort"
+	"strconv"
+	"strings"
+	"unicode/utf8"
+)
+
+type jpFunction func(arguments []interface{}) (interface{}, error)
+
+type jpType string
+
+const (
+	jpUnknown     jpType = "unknown"
+	jpNumber      jpType = "number"
+	jpString      jpType = "string"
+	jpArray       jpType = "array"
+	jpObject      jpType = "object"
+	jpArrayNumber jpType = "array[number]"
+	jpArrayString jpType = "array[string]"
+	jpExpref      jpType = "expref"
+	jpAny         jpType = "any"
+)
+
+type functionEntry struct {
+	name      string
+	arguments []argSpec
+	handler   jpFunction
+	hasExpRef bool
+}
+
+type argSpec struct {
+	types    []jpType
+	variadic bool
+}
+
+type byExprString struct {
+	intr     *treeInterpreter
+	node     ASTNode
+	items    []interface{}
+	hasError bool
+}
+
+func (a *byExprString) Len() int {
+	return len(a.items)
+}
+func (a *byExprString) Swap(i, j int) {
+	a.items[i], a.items[j] = a.items[j], a.items[i]
+}
+func (a *byExprString) Less(i, j int) bool {
+	first, err := a.intr.Execute(a.node, a.items[i])
+	if err != nil {
+		a.hasError = true
+		// Return a dummy value.
+		return true
+	}
+	ith, ok := first.(string)
+	if !ok {
+		a.hasError = true
+		return true
+	}
+	second, err := a.intr.Execute(a.node, a.items[j])
+	if err != nil {
+		a.hasError = true
+		// Return a dummy value.
+		return true
+	}
+	jth, ok := second.(string)
+	if !ok {
+		a.hasError = true
+		return true
+	}
+	return ith < jth
+}
+
+type byExprFloat struct {
+	intr     *treeInterpreter
+	node     ASTNode
+	items    []interface{}
+	hasError bool
+}
+
+func (a *byExprFloat) Len() int {
+	return len(a.items)
+}
+func (a *byExprFloat) Swap(i, j int) {
+	a.items[i], a.items[j] = a.items[j], a.items[i]
+}
+func (a *byExprFloat) Less(i, j int) bool {
+	first, err := a.intr.Execute(a.node, a.items[i])
+	if err != nil {
+		a.hasError = true
+		// Return a dummy value.
+		return true
+	}
+	ith, ok := first.(float64)
+	if !ok {
+		a.hasError = true
+		return true
+	}
+	second, err := a.intr.Execute(a.node, a.items[j])
+	if err != nil {
+		a.hasError = true
+		// Return a dummy value.
+		return true
+	}
+	jth, ok := second.(float64)
+	if !ok {
+		a.hasError = true
+		return true
+	}
+	return ith < jth
+}
+
+type functionCaller struct {
+	functionTable map[string]functionEntry
+}
+
+func newFunctionCaller() *functionCaller {
+	caller := &functionCaller{}
+	caller.functionTable = map[string]functionEntry{
+		"length": {
+			name: "length",
+			arguments: []argSpec{
+				{types: []jpType{jpString, jpArray, jpObject}},
+			},
+			handler: jpfLength,
+		},
+		"starts_with": {
+			name: "starts_with",
+			arguments: []argSpec{
+				{types: []jpType{jpString}},
+				{types: []jpType{jpString}},
+			},
+			handler: jpfStartsWith,
+		},
+		"abs": {
+			name: "abs",
+			arguments: []argSpec{
+				{types: []jpType{jpNumber}},
+			},
+			handler: jpfAbs,
+		},
+		"avg": {
+			name: "avg",
+			arguments: []argSpec{
+				{types: []jpType{jpArrayNumber}},
+			},
+			handler: jpfAvg,
+		},
+		"ceil": {
+			name: "ceil",
+			arguments: []argSpec{
+				{types: []jpType{jpNumber}},
+			},
+			handler: jpfCeil,
+		},
+		"contains": {
+			name: "contains",
+			arguments: []argSpec{
+				{types: []jpType{jpArray, jpString}},
+				{types: []jpType{jpAny}},
+			},
+			handler: jpfContains,
+		},
+		"ends_with": {
+			name: "ends_with",
+			arguments: []argSpec{
+				{types: []jpType{jpString}},
+				{types: []jpType{jpString}},
+			},
+			handler: jpfEndsWith,
+		},
+		"floor": {
+			name: "floor",
+			arguments: []argSpec{
+				{types: []jpType{jpNumber}},
+			},
+			handler: jpfFloor,
+		},
+		"map": {
+			name: "amp",
+			arguments: []argSpec{
+				{types: []jpType{jpExpref}},
+				{types: []jpType{jpArray}},
+			},
+			handler:   jpfMap,
+			hasExpRef: true,
+		},
+		"max": {
+			name: "max",
+			arguments: []argSpec{
+				{types: []jpType{jpArrayNumber, jpArrayString}},
+			},
+			handler: jpfMax,
+		},
+		"merge": {
+			name: "merge",
+			arguments: []argSpec{
+				{types: []jpType{jpObject}, variadic: true},
+			},
+			handler: jpfMerge,
+		},
+		"max_by": {
+			name: "max_by",
+			arguments: []argSpec{
+				{types: []jpType{jpArray}},
+				{types: []jpType{jpExpref}},
+			},
+			handler:   jpfMaxBy,
+			hasExpRef: true,
+		},
+		"sum": {
+			name: "sum",
+			arguments: []argSpec{
+				{types: []jpType{jpArrayNumber}},
+			},
+			handler: jpfSum,
+		},
+		"min": {
+			name: "min",
+			arguments: []argSpec{
+				{types: []jpType{jpArrayNumber, jpArrayString}},
+			},
+			handler: jpfMin,
+		},
+		"min_by": {
+			name: "min_by",
+			arguments: []argSpec{
+				{types: []jpType{jpArray}},
+				{types: []jpType{jpExpref}},
+			},
+			handler:   jpfMinBy,
+			hasExpRef: true,
+		},
+		"type": {
+			name: "type",
+			arguments: []argSpec{
+				{types: []jpType{jpAny}},
+			},
+			handler: jpfType,
+		},
+		"keys": {
+			name: "keys",
+			arguments: []argSpec{
+				{types: []jpType{jpObject}},
+			},
+			handler: jpfKeys,
+		},
+		"values": {
+			name: "values",
+			arguments: []argSpec{
+				{types: []jpType{jpObject}},
+			},
+			handler: jpfValues,
+		},
+		"sort": {
+			name: "sort",
+			arguments: []argSpec{
+				{types: []jpType{jpArrayString, jpArrayNumber}},
+			},
+			handler: jpfSort,
+		},
+		"sort_by": {
+			name: "sort_by",
+			arguments: []argSpec{
+				{types: []jpType{jpArray}},
+				{types: []jpType{jpExpref}},
+			},
+			handler:   jpfSortBy,
+			hasExpRef: true,
+		},
+		"join": {
+			name: "join",
+			arguments: []argSpec{
+				{types: []jpType{jpString}},
+				{types: []jpType{jpArrayString}},
+			},
+			handler: jpfJoin,
+		},
+		"reverse": {
+			name: "reverse",
+			arguments: []argSpec{
+				{types: []jpType{jpArray, jpString}},
+			},
+			handler: jpfReverse,
+		},
+		"to_array": {
+			name: "to_array",
+			arguments: []argSpec{
+				{types: []jpType{jpAny}},
+			},
+			handler: jpfToArray,
+		},
+		"to_string": {
+			name: "to_string",
+			arguments: []argSpec{
+				{types: []jpType{jpAny}},
+			},
+			handler: jpfToString,
+		},
+		"to_number": {
+			name: "to_number",
+			arguments: []argSpec{
+				{types: []jpType{jpAny}},
+			},
+			handler: jpfToNumber,
+		},
+		"not_null": {
+			name: "not_null",
+			arguments: []argSpec{
+				{types: []jpType{jpAny}, variadic: true},
+			},
+			handler: jpfNotNull,
+		},
+	}
+	return caller
+}
+
+func (e *functionEntry) resolveArgs(arguments []interface{}) ([]interface{}, error) {
+	if len(e.arguments) == 0 {
+		return arguments, nil
+	}
+	if !e.arguments[len(e.arguments)-1].variadic {
+		if len(e.arguments) != len(arguments) {
+			return nil, errors.New("incorrect number of args")
+		}
+		for i, spec := range e.arguments {
+			userArg := arguments[i]
+			err := spec.typeCheck(userArg)
+			if err != nil {
+				return nil, err
+			}
+		}
+		return arguments, nil
+	}
+	if len(arguments) < len(e.arguments) {
+		return nil, errors.New("Invalid arity.")
+	}
+	return arguments, nil
+}
+
+func (a *argSpec) typeCheck(arg interface{}) error {
+	for _, t := range a.types {
+		switch t {
+		case jpNumber:
+			if _, ok := arg.(float64); ok {
+				return nil
+			}
+		case jpString:
+			if _, ok := arg.(string); ok {
+				return nil
+			}
+		case jpArray:
+			if isSliceType(arg) {
+				return nil
+			}
+		case jpObject:
+			if _, ok := arg.(map[string]interface{}); ok {
+				return nil
+			}
+		case jpArrayNumber:
+			if _, ok := toArrayNum(arg); ok {
+				return nil
+			}
+		case jpArrayString:
+			if _, ok := toArrayStr(arg); ok {
+				return nil
+			}
+		case jpAny:
+			return nil
+		case jpExpref:
+			if _, ok := arg.(expRef); ok {
+				return nil
+			}
+		}
+	}
+	return fmt.Errorf("Invalid type for: %v, expected: %#v", arg, a.types)
+}
+
+func (f *functionCaller) CallFunction(name string, arguments []interface{}, intr *treeInterpreter) (interface{}, error) {
+	entry, ok := f.functionTable[name]
+	if !ok {
+		return nil, errors.New("unknown function: " + name)
+	}
+	resolvedArgs, err := entry.resolveArgs(arguments)
+	if err != nil {
+		return nil, err
+	}
+	if entry.hasExpRef {
+		var extra []interface{}
+		extra = append(extra, intr)
+		resolvedArgs = append(extra, resolvedArgs...)
+	}
+	return entry.handler(resolvedArgs)
+}
+
+func jpfAbs(arguments []interface{}) (interface{}, error) {
+	num := arguments[0].(float64)
+	return math.Abs(num), nil
+}
+
+func jpfLength(arguments []interface{}) (interface{}, error) {
+	arg := arguments[0]
+	if c, ok := arg.(string); ok {
+		return float64(utf8.RuneCountInString(c)), nil
+	} else if isSliceType(arg) {
+		v := reflect.ValueOf(arg)
+		return float64(v.Len()), nil
+	} else if c, ok := arg.(map[string]interface{}); ok {
+		return float64(len(c)), nil
+	}
+	return nil, errors.New("could not compute length()")
+}
+
+func jpfStartsWith(arguments []interface{}) (interface{}, error) {
+	search := arguments[0].(string)
+	prefix := arguments[1].(string)
+	return strings.HasPrefix(search, prefix), nil
+}
+
+func jpfAvg(arguments []interface{}) (interface{}, error) {
+	// We've already type checked the value so we can safely use
+	// type assertions.
+	args := arguments[0].([]interface{})
+	length := float64(len(args))
+	numerator := 0.0
+	for _, n := range args {
+		numerator += n.(float64)
+	}
+	return numerator / length, nil
+}
+func jpfCeil(arguments []interface{}) (interface{}, error) {
+	val := arguments[0].(float64)
+	return math.Ceil(val), nil
+}
+func jpfContains(arguments []interface{}) (interface{}, error) {
+	search := arguments[0]
+	el := arguments[1]
+	if searchStr, ok := search.(string); ok {
+		if elStr, ok := el.(string); ok {
+			return strings.Index(searchStr, elStr) != -1, nil
+		}
+		return false, nil
+	}
+	// Otherwise this is a generic contains for []interface{}
+	general := search.([]interface{})
+	for _, item := range general {
+		if item == el {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+func jpfEndsWith(arguments []interface{}) (interface{}, error) {
+	search := arguments[0].(string)
+	suffix := arguments[1].(string)
+	return strings.HasSuffix(search, suffix), nil
+}
+func jpfFloor(arguments []interface{}) (interface{}, error) {
+	val := arguments[0].(float64)
+	return math.Floor(val), nil
+}
+func jpfMap(arguments []interface{}) (interface{}, error) {
+	intr := arguments[0].(*treeInterpreter)
+	exp := arguments[1].(expRef)
+	node := exp.ref
+	arr := arguments[2].([]interface{})
+	mapped := make([]interface{}, 0, len(arr))
+	for _, value := range arr {
+		current, err := intr.Execute(node, value)
+		if err != nil {
+			return nil, err
+		}
+		mapped = append(mapped, current)
+	}
+	return mapped, nil
+}
+func jpfMax(arguments []interface{}) (interface{}, error) {
+	if items, ok := toArrayNum(arguments[0]); ok {
+		if len(items) == 0 {
+			return nil, nil
+		}
+		if len(items) == 1 {
+			return items[0], nil
+		}
+		best := items[0]
+		for _, item := range items[1:] {
+			if item > best {
+				best = item
+			}
+		}
+		return best, nil
+	}
+	// Otherwise we're dealing with a max() of strings.
+	items, _ := toArrayStr(arguments[0])
+	if len(items) == 0 {
+		return nil, nil
+	}
+	if len(items) == 1 {
+		return items[0], nil
+	}
+	best := items[0]
+	for _, item := range items[1:] {
+		if item > best {
+			best = item
+		}
+	}
+	return best, nil
+}
+func jpfMerge(arguments []interface{}) (interface{}, error) {
+	final := make(map[string]interface{})
+	for _, m := range arguments {
+		mapped := m.(map[string]interface{})
+		for key, value := range mapped {
+			final[key] = value
+		}
+	}
+	return final, nil
+}
+func jpfMaxBy(arguments []interface{}) (interface{}, error) {
+	intr := arguments[0].(*treeInterpreter)
+	arr := arguments[1].([]interface{})
+	exp := arguments[2].(expRef)
+	node := exp.ref
+	if len(arr) == 0 {
+		return nil, nil
+	} else if len(arr) == 1 {
+		return arr[0], nil
+	}
+	start, err := intr.Execute(node, arr[0])
+	if err != nil {
+		return nil, err
+	}
+	switch t := start.(type) {
+	case float64:
+		bestVal := t
+		bestItem := arr[0]
+		for _, item := range arr[1:] {
+			result, err := intr.Execute(node, item)
+			if err != nil {
+				return nil, err
+			}
+			current, ok := result.(float64)
+			if !ok {
+				return nil, errors.New("invalid type, must be number")
+			}
+			if current > bestVal {
+				bestVal = current
+				bestItem = item
+			}
+		}
+		return bestItem, nil
+	case string:
+		bestVal := t
+		bestItem := arr[0]
+		for _, item := range arr[1:] {
+			result, err := intr.Execute(node, item)
+			if err != nil {
+				return nil, err
+			}
+			current, ok := result.(string)
+			if !ok {
+				return nil, errors.New("invalid type, must be string")
+			}
+			if current > bestVal {
+				bestVal = current
+				bestItem = item
+			}
+		}
+		return bestItem, nil
+	default:
+		return nil, errors.New("invalid type, must be number of string")
+	}
+}
+func jpfSum(arguments []interface{}) (interface{}, error) {
+	items, _ := toArrayNum(arguments[0])
+	sum := 0.0
+	for _, item := range items {
+		sum += item
+	}
+	return sum, nil
+}
+
+func jpfMin(arguments []interface{}) (interface{}, error) {
+	if items, ok := toArrayNum(arguments[0]); ok {
+		if len(items) == 0 {
+			return nil, nil
+		}
+		if len(items) == 1 {
+			return items[0], nil
+		}
+		best := items[0]
+		for _, item := range items[1:] {
+			if item < best {
+				best = item
+			}
+		}
+		return best, nil
+	}
+	items, _ := toArrayStr(arguments[0])
+	if len(items) == 0 {
+		return nil, nil
+	}
+	if len(items) == 1 {
+		return items[0], nil
+	}
+	best := items[0]
+	for _, item := range items[1:] {
+		if item < best {
+			best = item
+		}
+	}
+	return best, nil
+}
+
+func jpfMinBy(arguments []interface{}) (interface{}, error) {
+	intr := arguments[0].(*treeInterpreter)
+	arr := arguments[1].([]interface{})
+	exp := arguments[2].(expRef)
+	node := exp.ref
+	if len(arr) == 0 {
+		return nil, nil
+	} else if len(arr) == 1 {
+		return arr[0], nil
+	}
+	start, err := intr.Execute(node, arr[0])
+	if err != nil {
+		return nil, err
+	}
+	if t, ok := start.(float64); ok {
+		bestVal := t
+		bestItem := arr[0]
+		for _, item := range arr[1:] {
+			result, err := intr.Execute(node, item)
+			if err != nil {
+				return nil, err
+			}
+			current, ok := result.(float64)
+			if !ok {
+				return nil, errors.New("invalid type, must be number")
+			}
+			if current < bestVal {
+				bestVal = current
+				bestItem = item
+			}
+		}
+		return bestItem, nil
+	} else if t, ok := start.(string); ok {
+		bestVal := t
+		bestItem := arr[0]
+		for _, item := range arr[1:] {
+			result, err := intr.Execute(node, item)
+			if err != nil {
+				return nil, err
+			}
+			current, ok := result.(string)
+			if !ok {
+				return nil, errors.New("invalid type, must be string")
+			}
+			if current < bestVal {
+				bestVal = current
+				bestItem = item
+			}
+		}
+		return bestItem, nil
+	} else {
+		return nil, errors.New("invalid type, must be number of string")
+	}
+}
+func jpfType(arguments []interface{}) (interface{}, error) {
+	arg := arguments[0]
+	if _, ok := arg.(float64); ok {
+		return "number", nil
+	}
+	if _, ok := arg.(string); ok {
+		return "string", nil
+	}
+	if _, ok := arg.([]interface{}); ok {
+		return "array", nil
+	}
+	if _, ok := arg.(map[string]interface{}); ok {
+		return "object", nil
+	}
+	if arg == nil {
+		return "null", nil
+	}
+	if arg == true || arg == false {
+		return "boolean", nil
+	}
+	return nil, errors.New("unknown type")
+}
+func jpfKeys(arguments []interface{}) (interface{}, error) {
+	arg := arguments[0].(map[string]interface{})
+	collected := make([]interface{}, 0, len(arg))
+	for key := range arg {
+		collected = append(collected, key)
+	}
+	return collected, nil
+}
+func jpfValues(arguments []interface{}) (interface{}, error) {
+	arg := arguments[0].(map[string]interface{})
+	collected := make([]interface{}, 0, len(arg))
+	for _, value := range arg {
+		collected = append(collected, value)
+	}
+	return collected, nil
+}
+func jpfSort(arguments []interface{}) (interface{}, error) {
+	if items, ok := toArrayNum(arguments[0]); ok {
+		d := sort.Float64Slice(items)
+		sort.Stable(d)
+		final := make([]interface{}, len(d))
+		for i, val := range d {
+			final[i] = val
+		}
+		return final, nil
+	}
+	// Otherwise we're dealing with sort()'ing strings.
+	items, _ := toArrayStr(arguments[0])
+	d := sort.StringSlice(items)
+	sort.Stable(d)
+	final := make([]interface{}, len(d))
+	for i, val := range d {
+		final[i] = val
+	}
+	return final, nil
+}
+func jpfSortBy(arguments []interface{}) (interface{}, error) {
+	intr := arguments[0].(*treeInterpreter)
+	arr := arguments[1].([]interface{})
+	exp := arguments[2].(expRef)
+	node := exp.ref
+	if len(arr) == 0 {
+		return arr, nil
+	} else if len(arr) == 1 {
+		return arr, nil
+	}
+	start, err := intr.Execute(node, arr[0])
+	if err != nil {
+		return nil, err
+	}
+	if _, ok := start.(float64); ok {
+		sortable := &byExprFloat{intr, node, arr, false}
+		sort.Stable(sortable)
+		if sortable.hasError {
+			return nil, errors.New("error in sort_by comparison")
+		}
+		return arr, nil
+	} else if _, ok := start.(string); ok {
+		sortable := &byExprString{intr, node, arr, false}
+		sort.Stable(sortable)
+		if sortable.hasError {
+			return nil, errors.New("error in sort_by comparison")
+		}
+		return arr, nil
+	} else {
+		return nil, errors.New("invalid type, must be number of string")
+	}
+}
+func jpfJoin(arguments []interface{}) (interface{}, error) {
+	sep := arguments[0].(string)
+	// We can't just do arguments[1].([]string), we have to
+	// manually convert each item to a string.
+	arrayStr := []string{}
+	for _, item := range arguments[1].([]interface{}) {
+		arrayStr = append(arrayStr, item.(string))
+	}
+	return strings.Join(arrayStr, sep), nil
+}
+func jpfReverse(arguments []interface{}) (interface{}, error) {
+	if s, ok := arguments[0].(string); ok {
+		r := []rune(s)
+		for i, j := 0, len(r)-1; i < len(r)/2; i, j = i+1, j-1 {
+			r[i], r[j] = r[j], r[i]
+		}
+		return string(r), nil
+	}
+	items := arguments[0].([]interface{})
+	length := len(items)
+	reversed := make([]interface{}, length)
+	for i, item := range items {
+		reversed[length-(i+1)] = item
+	}
+	return reversed, nil
+}
+func jpfToArray(arguments []interface{}) (interface{}, error) {
+	if _, ok := arguments[0].([]interface{}); ok {
+		return arguments[0], nil
+	}
+	return arguments[:1:1], nil
+}
+func jpfToString(arguments []interface{}) (interface{}, error) {
+	if v, ok := arguments[0].(string); ok {
+		return v, nil
+	}
+	result, err := json.Marshal(arguments[0])
+	if err != nil {
+		return nil, err
+	}
+	return string(result), nil
+}
+func jpfToNumber(arguments []interface{}) (interface{}, error) {
+	arg := arguments[0]
+	if v, ok := arg.(float64); ok {
+		return v, nil
+	}
+	if v, ok := arg.(string); ok {
+		conv, err := strconv.ParseFloat(v, 64)
+		if err != nil {
+			return nil, nil
+		}
+		return conv, nil
+	}
+	if _, ok := arg.([]interface{}); ok {
+		return nil, nil
+	}
+	if _, ok := arg.(map[string]interface{}); ok {
+		return nil, nil
+	}
+	if arg == nil {
+		return nil, nil
+	}
+	if arg == true || arg == false {
+		return nil, nil
+	}
+	return nil, errors.New("unknown type")
+}
+func jpfNotNull(arguments []interface{}) (interface{}, error) {
+	for _, arg := range arguments {
+		if arg != nil {
+			return arg, nil
+		}
+	}
+	return nil, nil
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/interpreter.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/interpreter.go
new file mode 100644
index 00000000..13c74604
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/interpreter.go
@@ -0,0 +1,418 @@
+package jmespath
+
+import (
+	"errors"
+	"reflect"
+	"unicode"
+	"unicode/utf8"
+)
+
+/* This is a tree based interpreter.  It walks the AST and directly
+   interprets the AST to search through a JSON document.
+*/
+
+type treeInterpreter struct {
+	fCall *functionCaller
+}
+
+func newInterpreter() *treeInterpreter {
+	interpreter := treeInterpreter{}
+	interpreter.fCall = newFunctionCaller()
+	return &interpreter
+}
+
+type expRef struct {
+	ref ASTNode
+}
+
+// Execute takes an ASTNode and input data and interprets the AST directly.
+// It will produce the result of applying the JMESPath expression associated
+// with the ASTNode to the input data "value".
+func (intr *treeInterpreter) Execute(node ASTNode, value interface{}) (interface{}, error) {
+	switch node.nodeType {
+	case ASTComparator:
+		left, err := intr.Execute(node.children[0], value)
+		if err != nil {
+			return nil, err
+		}
+		right, err := intr.Execute(node.children[1], value)
+		if err != nil {
+			return nil, err
+		}
+		switch node.value {
+		case tEQ:
+			return objsEqual(left, right), nil
+		case tNE:
+			return !objsEqual(left, right), nil
+		}
+		leftNum, ok := left.(float64)
+		if !ok {
+			return nil, nil
+		}
+		rightNum, ok := right.(float64)
+		if !ok {
+			return nil, nil
+		}
+		switch node.value {
+		case tGT:
+			return leftNum > rightNum, nil
+		case tGTE:
+			return leftNum >= rightNum, nil
+		case tLT:
+			return leftNum < rightNum, nil
+		case tLTE:
+			return leftNum <= rightNum, nil
+		}
+	case ASTExpRef:
+		return expRef{ref: node.children[0]}, nil
+	case ASTFunctionExpression:
+		resolvedArgs := []interface{}{}
+		for _, arg := range node.children {
+			current, err := intr.Execute(arg, value)
+			if err != nil {
+				return nil, err
+			}
+			resolvedArgs = append(resolvedArgs, current)
+		}
+		return intr.fCall.CallFunction(node.value.(string), resolvedArgs, intr)
+	case ASTField:
+		if m, ok := value.(map[string]interface{}); ok {
+			key := node.value.(string)
+			return m[key], nil
+		}
+		return intr.fieldFromStruct(node.value.(string), value)
+	case ASTFilterProjection:
+		left, err := intr.Execute(node.children[0], value)
+		if err != nil {
+			return nil, nil
+		}
+		sliceType, ok := left.([]interface{})
+		if !ok {
+			if isSliceType(left) {
+				return intr.filterProjectionWithReflection(node, left)
+			}
+			return nil, nil
+		}
+		compareNode := node.children[2]
+		collected := []interface{}{}
+		for _, element := range sliceType {
+			result, err := intr.Execute(compareNode, element)
+			if err != nil {
+				return nil, err
+			}
+			if !isFalse(result) {
+				current, err := intr.Execute(node.children[1], element)
+				if err != nil {
+					return nil, err
+				}
+				if current != nil {
+					collected = append(collected, current)
+				}
+			}
+		}
+		return collected, nil
+	case ASTFlatten:
+		left, err := intr.Execute(node.children[0], value)
+		if err != nil {
+			return nil, nil
+		}
+		sliceType, ok := left.([]interface{})
+		if !ok {
+			// If we can't type convert to []interface{}, there's
+			// a chance this could still work via reflection if we're
+			// dealing with user provided types.
+			if isSliceType(left) {
+				return intr.flattenWithReflection(left)
+			}
+			return nil, nil
+		}
+		flattened := []interface{}{}
+		for _, element := range sliceType {
+			if elementSlice, ok := element.([]interface{}); ok {
+				flattened = append(flattened, elementSlice...)
+			} else if isSliceType(element) {
+				reflectFlat := []interface{}{}
+				v := reflect.ValueOf(element)
+				for i := 0; i < v.Len(); i++ {
+					reflectFlat = append(reflectFlat, v.Index(i).Interface())
+				}
+				flattened = append(flattened, reflectFlat...)
+			} else {
+				flattened = append(flattened, element)
+			}
+		}
+		return flattened, nil
+	case ASTIdentity, ASTCurrentNode:
+		return value, nil
+	case ASTIndex:
+		if sliceType, ok := value.([]interface{}); ok {
+			index := node.value.(int)
+			if index < 0 {
+				index += len(sliceType)
+			}
+			if index < len(sliceType) && index >= 0 {
+				return sliceType[index], nil
+			}
+			return nil, nil
+		}
+		// Otherwise try via reflection.
+		rv := reflect.ValueOf(value)
+		if rv.Kind() == reflect.Slice {
+			index := node.value.(int)
+			if index < 0 {
+				index += rv.Len()
+			}
+			if index < rv.Len() && index >= 0 {
+				v := rv.Index(index)
+				return v.Interface(), nil
+			}
+		}
+		return nil, nil
+	case ASTKeyValPair:
+		return intr.Execute(node.children[0], value)
+	case ASTLiteral:
+		return node.value, nil
+	case ASTMultiSelectHash:
+		if value == nil {
+			return nil, nil
+		}
+		collected := make(map[string]interface{})
+		for _, child := range node.children {
+			current, err := intr.Execute(child, value)
+			if err != nil {
+				return nil, err
+			}
+			key := child.value.(string)
+			collected[key] = current
+		}
+		return collected, nil
+	case ASTMultiSelectList:
+		if value == nil {
+			return nil, nil
+		}
+		collected := []interface{}{}
+		for _, child := range node.children {
+			current, err := intr.Execute(child, value)
+			if err != nil {
+				return nil, err
+			}
+			collected = append(collected, current)
+		}
+		return collected, nil
+	case ASTOrExpression:
+		matched, err := intr.Execute(node.children[0], value)
+		if err != nil {
+			return nil, err
+		}
+		if isFalse(matched) {
+			matched, err = intr.Execute(node.children[1], value)
+			if err != nil {
+				return nil, err
+			}
+		}
+		return matched, nil
+	case ASTAndExpression:
+		matched, err := intr.Execute(node.children[0], value)
+		if err != nil {
+			return nil, err
+		}
+		if isFalse(matched) {
+			return matched, nil
+		}
+		return intr.Execute(node.children[1], value)
+	case ASTNotExpression:
+		matched, err := intr.Execute(node.children[0], value)
+		if err != nil {
+			return nil, err
+		}
+		if isFalse(matched) {
+			return true, nil
+		}
+		return false, nil
+	case ASTPipe:
+		result := value
+		var err error
+		for _, child := range node.children {
+			result, err = intr.Execute(child, result)
+			if err != nil {
+				return nil, err
+			}
+		}
+		return result, nil
+	case ASTProjection:
+		left, err := intr.Execute(node.children[0], value)
+		if err != nil {
+			return nil, err
+		}
+		sliceType, ok := left.([]interface{})
+		if !ok {
+			if isSliceType(left) {
+				return intr.projectWithReflection(node, left)
+			}
+			return nil, nil
+		}
+		collected := []interface{}{}
+		var current interface{}
+		for _, element := range sliceType {
+			current, err = intr.Execute(node.children[1], element)
+			if err != nil {
+				return nil, err
+			}
+			if current != nil {
+				collected = append(collected, current)
+			}
+		}
+		return collected, nil
+	case ASTSubexpression, ASTIndexExpression:
+		left, err := intr.Execute(node.children[0], value)
+		if err != nil {
+			return nil, err
+		}
+		return intr.Execute(node.children[1], left)
+	case ASTSlice:
+		sliceType, ok := value.([]interface{})
+		if !ok {
+			if isSliceType(value) {
+				return intr.sliceWithReflection(node, value)
+			}
+			return nil, nil
+		}
+		parts := node.value.([]*int)
+		sliceParams := make([]sliceParam, 3)
+		for i, part := range parts {
+			if part != nil {
+				sliceParams[i].Specified = true
+				sliceParams[i].N = *part
+			}
+		}
+		return slice(sliceType, sliceParams)
+	case ASTValueProjection:
+		left, err := intr.Execute(node.children[0], value)
+		if err != nil {
+			return nil, nil
+		}
+		mapType, ok := left.(map[string]interface{})
+		if !ok {
+			return nil, nil
+		}
+		values := make([]interface{}, len(mapType))
+		for _, value := range mapType {
+			values = append(values, value)
+		}
+		collected := []interface{}{}
+		for _, element := range values {
+			current, err := intr.Execute(node.children[1], element)
+			if err != nil {
+				return nil, err
+			}
+			if current != nil {
+				collected = append(collected, current)
+			}
+		}
+		return collected, nil
+	}
+	return nil, errors.New("Unknown AST node: " + node.nodeType.String())
+}
+
+func (intr *treeInterpreter) fieldFromStruct(key string, value interface{}) (interface{}, error) {
+	rv := reflect.ValueOf(value)
+	first, n := utf8.DecodeRuneInString(key)
+	fieldName := string(unicode.ToUpper(first)) + key[n:]
+	if rv.Kind() == reflect.Struct {
+		v := rv.FieldByName(fieldName)
+		if !v.IsValid() {
+			return nil, nil
+		}
+		return v.Interface(), nil
+	} else if rv.Kind() == reflect.Ptr {
+		// Handle multiple levels of indirection?
+		if rv.IsNil() {
+			return nil, nil
+		}
+		rv = rv.Elem()
+		v := rv.FieldByName(fieldName)
+		if !v.IsValid() {
+			return nil, nil
+		}
+		return v.Interface(), nil
+	}
+	return nil, nil
+}
+
+func (intr *treeInterpreter) flattenWithReflection(value interface{}) (interface{}, error) {
+	v := reflect.ValueOf(value)
+	flattened := []interface{}{}
+	for i := 0; i < v.Len(); i++ {
+		element := v.Index(i).Interface()
+		if reflect.TypeOf(element).Kind() == reflect.Slice {
+			// Then insert the contents of the element
+			// slice into the flattened slice,
+			// i.e flattened = append(flattened, mySlice...)
+			elementV := reflect.ValueOf(element)
+			for j := 0; j < elementV.Len(); j++ {
+				flattened = append(
+					flattened, elementV.Index(j).Interface())
+			}
+		} else {
+			flattened = append(flattened, element)
+		}
+	}
+	return flattened, nil
+}
+
+func (intr *treeInterpreter) sliceWithReflection(node ASTNode, value interface{}) (interface{}, error) {
+	v := reflect.ValueOf(value)
+	parts := node.value.([]*int)
+	sliceParams := make([]sliceParam, 3)
+	for i, part := range parts {
+		if part != nil {
+			sliceParams[i].Specified = true
+			sliceParams[i].N = *part
+		}
+	}
+	final := []interface{}{}
+	for i := 0; i < v.Len(); i++ {
+		element := v.Index(i).Interface()
+		final = append(final, element)
+	}
+	return slice(final, sliceParams)
+}
+
+func (intr *treeInterpreter) filterProjectionWithReflection(node ASTNode, value interface{}) (interface{}, error) {
+	compareNode := node.children[2]
+	collected := []interface{}{}
+	v := reflect.ValueOf(value)
+	for i := 0; i < v.Len(); i++ {
+		element := v.Index(i).Interface()
+		result, err := intr.Execute(compareNode, element)
+		if err != nil {
+			return nil, err
+		}
+		if !isFalse(result) {
+			current, err := intr.Execute(node.children[1], element)
+			if err != nil {
+				return nil, err
+			}
+			if current != nil {
+				collected = append(collected, current)
+			}
+		}
+	}
+	return collected, nil
+}
+
+func (intr *treeInterpreter) projectWithReflection(node ASTNode, value interface{}) (interface{}, error) {
+	collected := []interface{}{}
+	v := reflect.ValueOf(value)
+	for i := 0; i < v.Len(); i++ {
+		element := v.Index(i).Interface()
+		result, err := intr.Execute(node.children[1], element)
+		if err != nil {
+			return nil, err
+		}
+		if result != nil {
+			collected = append(collected, result)
+		}
+	}
+	return collected, nil
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/lexer.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/lexer.go
new file mode 100644
index 00000000..817900c8
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/lexer.go
@@ -0,0 +1,420 @@
+package jmespath
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"strconv"
+	"strings"
+	"unicode/utf8"
+)
+
+type token struct {
+	tokenType tokType
+	value     string
+	position  int
+	length    int
+}
+
+type tokType int
+
+const eof = -1
+
+// Lexer contains information about the expression being tokenized.
+type Lexer struct {
+	expression string       // The expression provided by the user.
+	currentPos int          // The current position in the string.
+	lastWidth  int          // The width of the current rune.  This
+	buf        bytes.Buffer // Internal buffer used for building up values.
+}
+
+// SyntaxError is the main error used whenever a lexing or parsing error occurs.
+type SyntaxError struct {
+	msg        string // Error message displayed to user
+	Expression string // Expression that generated a SyntaxError
+	Offset     int    // The location in the string where the error occurred
+}
+
+func (e SyntaxError) Error() string {
+	// In the future, it would be good to underline the specific
+	// location where the error occurred.
+	return "SyntaxError: " + e.msg
+}
+
+// HighlightLocation will show where the syntax error occurred.
+// It will place a "^" character on a line below the expression
+// at the point where the syntax error occurred.
+func (e SyntaxError) HighlightLocation() string {
+	return e.Expression + "\n" + strings.Repeat(" ", e.Offset) + "^"
+}
+
+//go:generate stringer -type=tokType
+const (
+	tUnknown tokType = iota
+	tStar
+	tDot
+	tFilter
+	tFlatten
+	tLparen
+	tRparen
+	tLbracket
+	tRbracket
+	tLbrace
+	tRbrace
+	tOr
+	tPipe
+	tNumber
+	tUnquotedIdentifier
+	tQuotedIdentifier
+	tComma
+	tColon
+	tLT
+	tLTE
+	tGT
+	tGTE
+	tEQ
+	tNE
+	tJSONLiteral
+	tStringLiteral
+	tCurrent
+	tExpref
+	tAnd
+	tNot
+	tEOF
+)
+
+var basicTokens = map[rune]tokType{
+	'.': tDot,
+	'*': tStar,
+	',': tComma,
+	':': tColon,
+	'{': tLbrace,
+	'}': tRbrace,
+	']': tRbracket, // tLbracket not included because it could be "[]"
+	'(': tLparen,
+	')': tRparen,
+	'@': tCurrent,
+}
+
+// Bit mask for [a-zA-Z_] shifted down 64 bits to fit in a single uint64.
+// When using this bitmask just be sure to shift the rune down 64 bits
+// before checking against identifierStartBits.
+const identifierStartBits uint64 = 576460745995190270
+
+// Bit mask for [a-zA-Z0-9], 128 bits -> 2 uint64s.
+var identifierTrailingBits = [2]uint64{287948901175001088, 576460745995190270}
+
+var whiteSpace = map[rune]bool{
+	' ': true, '\t': true, '\n': true, '\r': true,
+}
+
+func (t token) String() string {
+	return fmt.Sprintf("Token{%+v, %s, %d, %d}",
+		t.tokenType, t.value, t.position, t.length)
+}
+
+// NewLexer creates a new JMESPath lexer.
+func NewLexer() *Lexer {
+	lexer := Lexer{}
+	return &lexer
+}
+
+func (lexer *Lexer) next() rune {
+	if lexer.currentPos >= len(lexer.expression) {
+		lexer.lastWidth = 0
+		return eof
+	}
+	r, w := utf8.DecodeRuneInString(lexer.expression[lexer.currentPos:])
+	lexer.lastWidth = w
+	lexer.currentPos += w
+	return r
+}
+
+func (lexer *Lexer) back() {
+	lexer.currentPos -= lexer.lastWidth
+}
+
+func (lexer *Lexer) peek() rune {
+	t := lexer.next()
+	lexer.back()
+	return t
+}
+
+// tokenize takes an expression and returns corresponding tokens.
+func (lexer *Lexer) tokenize(expression string) ([]token, error) {
+	var tokens []token
+	lexer.expression = expression
+	lexer.currentPos = 0
+	lexer.lastWidth = 0
+loop:
+	for {
+		r := lexer.next()
+		if identifierStartBits&(1<<(uint64(r)-64)) > 0 {
+			t := lexer.consumeUnquotedIdentifier()
+			tokens = append(tokens, t)
+		} else if val, ok := basicTokens[r]; ok {
+			// Basic single char token.
+			t := token{
+				tokenType: val,
+				value:     string(r),
+				position:  lexer.currentPos - lexer.lastWidth,
+				length:    1,
+			}
+			tokens = append(tokens, t)
+		} else if r == '-' || (r >= '0' && r <= '9') {
+			t := lexer.consumeNumber()
+			tokens = append(tokens, t)
+		} else if r == '[' {
+			t := lexer.consumeLBracket()
+			tokens = append(tokens, t)
+		} else if r == '"' {
+			t, err := lexer.consumeQuotedIdentifier()
+			if err != nil {
+				return tokens, err
+			}
+			tokens = append(tokens, t)
+		} else if r == '\'' {
+			t, err := lexer.consumeRawStringLiteral()
+			if err != nil {
+				return tokens, err
+			}
+			tokens = append(tokens, t)
+		} else if r == '`' {
+			t, err := lexer.consumeLiteral()
+			if err != nil {
+				return tokens, err
+			}
+			tokens = append(tokens, t)
+		} else if r == '|' {
+			t := lexer.matchOrElse(r, '|', tOr, tPipe)
+			tokens = append(tokens, t)
+		} else if r == '<' {
+			t := lexer.matchOrElse(r, '=', tLTE, tLT)
+			tokens = append(tokens, t)
+		} else if r == '>' {
+			t := lexer.matchOrElse(r, '=', tGTE, tGT)
+			tokens = append(tokens, t)
+		} else if r == '!' {
+			t := lexer.matchOrElse(r, '=', tNE, tNot)
+			tokens = append(tokens, t)
+		} else if r == '=' {
+			t := lexer.matchOrElse(r, '=', tEQ, tUnknown)
+			tokens = append(tokens, t)
+		} else if r == '&' {
+			t := lexer.matchOrElse(r, '&', tAnd, tExpref)
+			tokens = append(tokens, t)
+		} else if r == eof {
+			break loop
+		} else if _, ok := whiteSpace[r]; ok {
+			// Ignore whitespace
+		} else {
+			return tokens, lexer.syntaxError(fmt.Sprintf("Unknown char: %s", strconv.QuoteRuneToASCII(r)))
+		}
+	}
+	tokens = append(tokens, token{tEOF, "", len(lexer.expression), 0})
+	return tokens, nil
+}
+
+// Consume characters until the ending rune "r" is reached.
+// If the end of the expression is reached before seeing the
+// terminating rune "r", then an error is returned.
+// If no error occurs then the matching substring is returned.
+// The returned string will not include the ending rune.
+func (lexer *Lexer) consumeUntil(end rune) (string, error) {
+	start := lexer.currentPos
+	current := lexer.next()
+	for current != end && current != eof {
+		if current == '\\' && lexer.peek() != eof {
+			lexer.next()
+		}
+		current = lexer.next()
+	}
+	if lexer.lastWidth == 0 {
+		// Then we hit an EOF so we never reached the closing
+		// delimiter.
+		return "", SyntaxError{
+			msg:        "Unclosed delimiter: " + string(end),
+			Expression: lexer.expression,
+			Offset:     len(lexer.expression),
+		}
+	}
+	return lexer.expression[start : lexer.currentPos-lexer.lastWidth], nil
+}
+
+func (lexer *Lexer) consumeLiteral() (token, error) {
+	start := lexer.currentPos
+	value, err := lexer.consumeUntil('`')
+	if err != nil {
+		return token{}, err
+	}
+	value = strings.Replace(value, "\\`", "`", -1)
+	return token{
+		tokenType: tJSONLiteral,
+		value:     value,
+		position:  start,
+		length:    len(value),
+	}, nil
+}
+
+func (lexer *Lexer) consumeRawStringLiteral() (token, error) {
+	start := lexer.currentPos
+	currentIndex := start
+	current := lexer.next()
+	for current != '\'' && lexer.peek() != eof {
+		if current == '\\' && lexer.peek() == '\'' {
+			chunk := lexer.expression[currentIndex : lexer.currentPos-1]
+			lexer.buf.WriteString(chunk)
+			lexer.buf.WriteString("'")
+			lexer.next()
+			currentIndex = lexer.currentPos
+		}
+		current = lexer.next()
+	}
+	if lexer.lastWidth == 0 {
+		// Then we hit an EOF so we never reached the closing
+		// delimiter.
+		return token{}, SyntaxError{
+			msg:        "Unclosed delimiter: '",
+			Expression: lexer.expression,
+			Offset:     len(lexer.expression),
+		}
+	}
+	if currentIndex < lexer.currentPos {
+		lexer.buf.WriteString(lexer.expression[currentIndex : lexer.currentPos-1])
+	}
+	value := lexer.buf.String()
+	// Reset the buffer so it can reused again.
+	lexer.buf.Reset()
+	return token{
+		tokenType: tStringLiteral,
+		value:     value,
+		position:  start,
+		length:    len(value),
+	}, nil
+}
+
+func (lexer *Lexer) syntaxError(msg string) SyntaxError {
+	return SyntaxError{
+		msg:        msg,
+		Expression: lexer.expression,
+		Offset:     lexer.currentPos - 1,
+	}
+}
+
+// Checks for a two char token, otherwise matches a single character
+// token. This is used whenever a two char token overlaps a single
+// char token, e.g. "||" -> tPipe, "|" -> tOr.
+func (lexer *Lexer) matchOrElse(first rune, second rune, matchedType tokType, singleCharType tokType) token {
+	start := lexer.currentPos - lexer.lastWidth
+	nextRune := lexer.next()
+	var t token
+	if nextRune == second {
+		t = token{
+			tokenType: matchedType,
+			value:     string(first) + string(second),
+			position:  start,
+			length:    2,
+		}
+	} else {
+		lexer.back()
+		t = token{
+			tokenType: singleCharType,
+			value:     string(first),
+			position:  start,
+			length:    1,
+		}
+	}
+	return t
+}
+
+func (lexer *Lexer) consumeLBracket() token {
+	// There's three options here:
+	// 1. A filter expression "[?"
+	// 2. A flatten operator "[]"
+	// 3. A bare rbracket "["
+	start := lexer.currentPos - lexer.lastWidth
+	nextRune := lexer.next()
+	var t token
+	if nextRune == '?' {
+		t = token{
+			tokenType: tFilter,
+			value:     "[?",
+			position:  start,
+			length:    2,
+		}
+	} else if nextRune == ']' {
+		t = token{
+			tokenType: tFlatten,
+			value:     "[]",
+			position:  start,
+			length:    2,
+		}
+	} else {
+		t = token{
+			tokenType: tLbracket,
+			value:     "[",
+			position:  start,
+			length:    1,
+		}
+		lexer.back()
+	}
+	return t
+}
+
+func (lexer *Lexer) consumeQuotedIdentifier() (token, error) {
+	start := lexer.currentPos
+	value, err := lexer.consumeUntil('"')
+	if err != nil {
+		return token{}, err
+	}
+	var decoded string
+	asJSON := []byte("\"" + value + "\"")
+	if err := json.Unmarshal([]byte(asJSON), &decoded); err != nil {
+		return token{}, err
+	}
+	return token{
+		tokenType: tQuotedIdentifier,
+		value:     decoded,
+		position:  start - 1,
+		length:    len(decoded),
+	}, nil
+}
+
+func (lexer *Lexer) consumeUnquotedIdentifier() token {
+	// Consume runes until we reach the end of an unquoted
+	// identifier.
+	start := lexer.currentPos - lexer.lastWidth
+	for {
+		r := lexer.next()
+		if r < 0 || r > 128 || identifierTrailingBits[uint64(r)/64]&(1<<(uint64(r)%64)) == 0 {
+			lexer.back()
+			break
+		}
+	}
+	value := lexer.expression[start:lexer.currentPos]
+	return token{
+		tokenType: tUnquotedIdentifier,
+		value:     value,
+		position:  start,
+		length:    lexer.currentPos - start,
+	}
+}
+
+func (lexer *Lexer) consumeNumber() token {
+	// Consume runes until we reach something that's not a number.
+	start := lexer.currentPos - lexer.lastWidth
+	for {
+		r := lexer.next()
+		if r < '0' || r > '9' {
+			lexer.back()
+			break
+		}
+	}
+	value := lexer.expression[start:lexer.currentPos]
+	return token{
+		tokenType: tNumber,
+		value:     value,
+		position:  start,
+		length:    lexer.currentPos - start,
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/parser.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/parser.go
new file mode 100644
index 00000000..1240a175
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/parser.go
@@ -0,0 +1,603 @@
+package jmespath
+
+import (
+	"encoding/json"
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+type astNodeType int
+
+//go:generate stringer -type astNodeType
+const (
+	ASTEmpty astNodeType = iota
+	ASTComparator
+	ASTCurrentNode
+	ASTExpRef
+	ASTFunctionExpression
+	ASTField
+	ASTFilterProjection
+	ASTFlatten
+	ASTIdentity
+	ASTIndex
+	ASTIndexExpression
+	ASTKeyValPair
+	ASTLiteral
+	ASTMultiSelectHash
+	ASTMultiSelectList
+	ASTOrExpression
+	ASTAndExpression
+	ASTNotExpression
+	ASTPipe
+	ASTProjection
+	ASTSubexpression
+	ASTSlice
+	ASTValueProjection
+)
+
+// ASTNode represents the abstract syntax tree of a JMESPath expression.
+type ASTNode struct {
+	nodeType astNodeType
+	value    interface{}
+	children []ASTNode
+}
+
+func (node ASTNode) String() string {
+	return node.PrettyPrint(0)
+}
+
+// PrettyPrint will pretty print the parsed AST.
+// The AST is an implementation detail and this pretty print
+// function is provided as a convenience method to help with
+// debugging.  You should not rely on its output as the internal
+// structure of the AST may change at any time.
+func (node ASTNode) PrettyPrint(indent int) string {
+	spaces := strings.Repeat(" ", indent)
+	output := fmt.Sprintf("%s%s {\n", spaces, node.nodeType)
+	nextIndent := indent + 2
+	if node.value != nil {
+		if converted, ok := node.value.(fmt.Stringer); ok {
+			// Account for things like comparator nodes
+			// that are enums with a String() method.
+			output += fmt.Sprintf("%svalue: %s\n", strings.Repeat(" ", nextIndent), converted.String())
+		} else {
+			output += fmt.Sprintf("%svalue: %#v\n", strings.Repeat(" ", nextIndent), node.value)
+		}
+	}
+	lastIndex := len(node.children)
+	if lastIndex > 0 {
+		output += fmt.Sprintf("%schildren: {\n", strings.Repeat(" ", nextIndent))
+		childIndent := nextIndent + 2
+		for _, elem := range node.children {
+			output += elem.PrettyPrint(childIndent)
+		}
+	}
+	output += fmt.Sprintf("%s}\n", spaces)
+	return output
+}
+
+var bindingPowers = map[tokType]int{
+	tEOF:                0,
+	tUnquotedIdentifier: 0,
+	tQuotedIdentifier:   0,
+	tRbracket:           0,
+	tRparen:             0,
+	tComma:              0,
+	tRbrace:             0,
+	tNumber:             0,
+	tCurrent:            0,
+	tExpref:             0,
+	tColon:              0,
+	tPipe:               1,
+	tOr:                 2,
+	tAnd:                3,
+	tEQ:                 5,
+	tLT:                 5,
+	tLTE:                5,
+	tGT:                 5,
+	tGTE:                5,
+	tNE:                 5,
+	tFlatten:            9,
+	tStar:               20,
+	tFilter:             21,
+	tDot:                40,
+	tNot:                45,
+	tLbrace:             50,
+	tLbracket:           55,
+	tLparen:             60,
+}
+
+// Parser holds state about the current expression being parsed.
+type Parser struct {
+	expression string
+	tokens     []token
+	index      int
+}
+
+// NewParser creates a new JMESPath parser.
+func NewParser() *Parser {
+	p := Parser{}
+	return &p
+}
+
+// Parse will compile a JMESPath expression.
+func (p *Parser) Parse(expression string) (ASTNode, error) {
+	lexer := NewLexer()
+	p.expression = expression
+	p.index = 0
+	tokens, err := lexer.tokenize(expression)
+	if err != nil {
+		return ASTNode{}, err
+	}
+	p.tokens = tokens
+	parsed, err := p.parseExpression(0)
+	if err != nil {
+		return ASTNode{}, err
+	}
+	if p.current() != tEOF {
+		return ASTNode{}, p.syntaxError(fmt.Sprintf(
+			"Unexpected token at the end of the expresssion: %s", p.current()))
+	}
+	return parsed, nil
+}
+
+func (p *Parser) parseExpression(bindingPower int) (ASTNode, error) {
+	var err error
+	leftToken := p.lookaheadToken(0)
+	p.advance()
+	leftNode, err := p.nud(leftToken)
+	if err != nil {
+		return ASTNode{}, err
+	}
+	currentToken := p.current()
+	for bindingPower < bindingPowers[currentToken] {
+		p.advance()
+		leftNode, err = p.led(currentToken, leftNode)
+		if err != nil {
+			return ASTNode{}, err
+		}
+		currentToken = p.current()
+	}
+	return leftNode, nil
+}
+
+func (p *Parser) parseIndexExpression() (ASTNode, error) {
+	if p.lookahead(0) == tColon || p.lookahead(1) == tColon {
+		return p.parseSliceExpression()
+	}
+	indexStr := p.lookaheadToken(0).value
+	parsedInt, err := strconv.Atoi(indexStr)
+	if err != nil {
+		return ASTNode{}, err
+	}
+	indexNode := ASTNode{nodeType: ASTIndex, value: parsedInt}
+	p.advance()
+	if err := p.match(tRbracket); err != nil {
+		return ASTNode{}, err
+	}
+	return indexNode, nil
+}
+
+func (p *Parser) parseSliceExpression() (ASTNode, error) {
+	parts := []*int{nil, nil, nil}
+	index := 0
+	current := p.current()
+	for current != tRbracket && index < 3 {
+		if current == tColon {
+			index++
+			p.advance()
+		} else if current == tNumber {
+			parsedInt, err := strconv.Atoi(p.lookaheadToken(0).value)
+			if err != nil {
+				return ASTNode{}, err
+			}
+			parts[index] = &parsedInt
+			p.advance()
+		} else {
+			return ASTNode{}, p.syntaxError(
+				"Expected tColon or tNumber" + ", received: " + p.current().String())
+		}
+		current = p.current()
+	}
+	if err := p.match(tRbracket); err != nil {
+		return ASTNode{}, err
+	}
+	return ASTNode{
+		nodeType: ASTSlice,
+		value:    parts,
+	}, nil
+}
+
+func (p *Parser) match(tokenType tokType) error {
+	if p.current() == tokenType {
+		p.advance()
+		return nil
+	}
+	return p.syntaxError("Expected " + tokenType.String() + ", received: " + p.current().String())
+}
+
+func (p *Parser) led(tokenType tokType, node ASTNode) (ASTNode, error) {
+	switch tokenType {
+	case tDot:
+		if p.current() != tStar {
+			right, err := p.parseDotRHS(bindingPowers[tDot])
+			return ASTNode{
+				nodeType: ASTSubexpression,
+				children: []ASTNode{node, right},
+			}, err
+		}
+		p.advance()
+		right, err := p.parseProjectionRHS(bindingPowers[tDot])
+		return ASTNode{
+			nodeType: ASTValueProjection,
+			children: []ASTNode{node, right},
+		}, err
+	case tPipe:
+		right, err := p.parseExpression(bindingPowers[tPipe])
+		return ASTNode{nodeType: ASTPipe, children: []ASTNode{node, right}}, err
+	case tOr:
+		right, err := p.parseExpression(bindingPowers[tOr])
+		return ASTNode{nodeType: ASTOrExpression, children: []ASTNode{node, right}}, err
+	case tAnd:
+		right, err := p.parseExpression(bindingPowers[tAnd])
+		return ASTNode{nodeType: ASTAndExpression, children: []ASTNode{node, right}}, err
+	case tLparen:
+		name := node.value
+		var args []ASTNode
+		for p.current() != tRparen {
+			expression, err := p.parseExpression(0)
+			if err != nil {
+				return ASTNode{}, err
+			}
+			if p.current() == tComma {
+				if err := p.match(tComma); err != nil {
+					return ASTNode{}, err
+				}
+			}
+			args = append(args, expression)
+		}
+		if err := p.match(tRparen); err != nil {
+			return ASTNode{}, err
+		}
+		return ASTNode{
+			nodeType: ASTFunctionExpression,
+			value:    name,
+			children: args,
+		}, nil
+	case tFilter:
+		return p.parseFilter(node)
+	case tFlatten:
+		left := ASTNode{nodeType: ASTFlatten, children: []ASTNode{node}}
+		right, err := p.parseProjectionRHS(bindingPowers[tFlatten])
+		return ASTNode{
+			nodeType: ASTProjection,
+			children: []ASTNode{left, right},
+		}, err
+	case tEQ, tNE, tGT, tGTE, tLT, tLTE:
+		right, err := p.parseExpression(bindingPowers[tokenType])
+		if err != nil {
+			return ASTNode{}, err
+		}
+		return ASTNode{
+			nodeType: ASTComparator,
+			value:    tokenType,
+			children: []ASTNode{node, right},
+		}, nil
+	case tLbracket:
+		tokenType := p.current()
+		var right ASTNode
+		var err error
+		if tokenType == tNumber || tokenType == tColon {
+			right, err = p.parseIndexExpression()
+			if err != nil {
+				return ASTNode{}, err
+			}
+			return p.projectIfSlice(node, right)
+		}
+		// Otherwise this is a projection.
+		if err := p.match(tStar); err != nil {
+			return ASTNode{}, err
+		}
+		if err := p.match(tRbracket); err != nil {
+			return ASTNode{}, err
+		}
+		right, err = p.parseProjectionRHS(bindingPowers[tStar])
+		if err != nil {
+			return ASTNode{}, err
+		}
+		return ASTNode{
+			nodeType: ASTProjection,
+			children: []ASTNode{node, right},
+		}, nil
+	}
+	return ASTNode{}, p.syntaxError("Unexpected token: " + tokenType.String())
+}
+
+func (p *Parser) nud(token token) (ASTNode, error) {
+	switch token.tokenType {
+	case tJSONLiteral:
+		var parsed interface{}
+		err := json.Unmarshal([]byte(token.value), &parsed)
+		if err != nil {
+			return ASTNode{}, err
+		}
+		return ASTNode{nodeType: ASTLiteral, value: parsed}, nil
+	case tStringLiteral:
+		return ASTNode{nodeType: ASTLiteral, value: token.value}, nil
+	case tUnquotedIdentifier:
+		return ASTNode{
+			nodeType: ASTField,
+			value:    token.value,
+		}, nil
+	case tQuotedIdentifier:
+		node := ASTNode{nodeType: ASTField, value: token.value}
+		if p.current() == tLparen {
+			return ASTNode{}, p.syntaxErrorToken("Can't have quoted identifier as function name.", token)
+		}
+		return node, nil
+	case tStar:
+		left := ASTNode{nodeType: ASTIdentity}
+		var right ASTNode
+		var err error
+		if p.current() == tRbracket {
+			right = ASTNode{nodeType: ASTIdentity}
+		} else {
+			right, err = p.parseProjectionRHS(bindingPowers[tStar])
+		}
+		return ASTNode{nodeType: ASTValueProjection, children: []ASTNode{left, right}}, err
+	case tFilter:
+		return p.parseFilter(ASTNode{nodeType: ASTIdentity})
+	case tLbrace:
+		return p.parseMultiSelectHash()
+	case tFlatten:
+		left := ASTNode{
+			nodeType: ASTFlatten,
+			children: []ASTNode{{nodeType: ASTIdentity}},
+		}
+		right, err := p.parseProjectionRHS(bindingPowers[tFlatten])
+		if err != nil {
+			return ASTNode{}, err
+		}
+		return ASTNode{nodeType: ASTProjection, children: []ASTNode{left, right}}, nil
+	case tLbracket:
+		tokenType := p.current()
+		//var right ASTNode
+		if tokenType == tNumber || tokenType == tColon {
+			right, err := p.parseIndexExpression()
+			if err != nil {
+				return ASTNode{}, nil
+			}
+			return p.projectIfSlice(ASTNode{nodeType: ASTIdentity}, right)
+		} else if tokenType == tStar && p.lookahead(1) == tRbracket {
+			p.advance()
+			p.advance()
+			right, err := p.parseProjectionRHS(bindingPowers[tStar])
+			if err != nil {
+				return ASTNode{}, err
+			}
+			return ASTNode{
+				nodeType: ASTProjection,
+				children: []ASTNode{{nodeType: ASTIdentity}, right},
+			}, nil
+		} else {
+			return p.parseMultiSelectList()
+		}
+	case tCurrent:
+		return ASTNode{nodeType: ASTCurrentNode}, nil
+	case tExpref:
+		expression, err := p.parseExpression(bindingPowers[tExpref])
+		if err != nil {
+			return ASTNode{}, err
+		}
+		return ASTNode{nodeType: ASTExpRef, children: []ASTNode{expression}}, nil
+	case tNot:
+		expression, err := p.parseExpression(bindingPowers[tNot])
+		if err != nil {
+			return ASTNode{}, err
+		}
+		return ASTNode{nodeType: ASTNotExpression, children: []ASTNode{expression}}, nil
+	case tLparen:
+		expression, err := p.parseExpression(0)
+		if err != nil {
+			return ASTNode{}, err
+		}
+		if err := p.match(tRparen); err != nil {
+			return ASTNode{}, err
+		}
+		return expression, nil
+	case tEOF:
+		return ASTNode{}, p.syntaxErrorToken("Incomplete expression", token)
+	}
+
+	return ASTNode{}, p.syntaxErrorToken("Invalid token: "+token.tokenType.String(), token)
+}
+
+func (p *Parser) parseMultiSelectList() (ASTNode, error) {
+	var expressions []ASTNode
+	for {
+		expression, err := p.parseExpression(0)
+		if err != nil {
+			return ASTNode{}, err
+		}
+		expressions = append(expressions, expression)
+		if p.current() == tRbracket {
+			break
+		}
+		err = p.match(tComma)
+		if err != nil {
+			return ASTNode{}, err
+		}
+	}
+	err := p.match(tRbracket)
+	if err != nil {
+		return ASTNode{}, err
+	}
+	return ASTNode{
+		nodeType: ASTMultiSelectList,
+		children: expressions,
+	}, nil
+}
+
+func (p *Parser) parseMultiSelectHash() (ASTNode, error) {
+	var children []ASTNode
+	for {
+		keyToken := p.lookaheadToken(0)
+		if err := p.match(tUnquotedIdentifier); err != nil {
+			if err := p.match(tQuotedIdentifier); err != nil {
+				return ASTNode{}, p.syntaxError("Expected tQuotedIdentifier or tUnquotedIdentifier")
+			}
+		}
+		keyName := keyToken.value
+		err := p.match(tColon)
+		if err != nil {
+			return ASTNode{}, err
+		}
+		value, err := p.parseExpression(0)
+		if err != nil {
+			return ASTNode{}, err
+		}
+		node := ASTNode{
+			nodeType: ASTKeyValPair,
+			value:    keyName,
+			children: []ASTNode{value},
+		}
+		children = append(children, node)
+		if p.current() == tComma {
+			err := p.match(tComma)
+			if err != nil {
+				return ASTNode{}, nil
+			}
+		} else if p.current() == tRbrace {
+			err := p.match(tRbrace)
+			if err != nil {
+				return ASTNode{}, nil
+			}
+			break
+		}
+	}
+	return ASTNode{
+		nodeType: ASTMultiSelectHash,
+		children: children,
+	}, nil
+}
+
+func (p *Parser) projectIfSlice(left ASTNode, right ASTNode) (ASTNode, error) {
+	indexExpr := ASTNode{
+		nodeType: ASTIndexExpression,
+		children: []ASTNode{left, right},
+	}
+	if right.nodeType == ASTSlice {
+		right, err := p.parseProjectionRHS(bindingPowers[tStar])
+		return ASTNode{
+			nodeType: ASTProjection,
+			children: []ASTNode{indexExpr, right},
+		}, err
+	}
+	return indexExpr, nil
+}
+func (p *Parser) parseFilter(node ASTNode) (ASTNode, error) {
+	var right, condition ASTNode
+	var err error
+	condition, err = p.parseExpression(0)
+	if err != nil {
+		return ASTNode{}, err
+	}
+	if err := p.match(tRbracket); err != nil {
+		return ASTNode{}, err
+	}
+	if p.current() == tFlatten {
+		right = ASTNode{nodeType: ASTIdentity}
+	} else {
+		right, err = p.parseProjectionRHS(bindingPowers[tFilter])
+		if err != nil {
+			return ASTNode{}, err
+		}
+	}
+
+	return ASTNode{
+		nodeType: ASTFilterProjection,
+		children: []ASTNode{node, right, condition},
+	}, nil
+}
+
+func (p *Parser) parseDotRHS(bindingPower int) (ASTNode, error) {
+	lookahead := p.current()
+	if tokensOneOf([]tokType{tQuotedIdentifier, tUnquotedIdentifier, tStar}, lookahead) {
+		return p.parseExpression(bindingPower)
+	} else if lookahead == tLbracket {
+		if err := p.match(tLbracket); err != nil {
+			return ASTNode{}, err
+		}
+		return p.parseMultiSelectList()
+	} else if lookahead == tLbrace {
+		if err := p.match(tLbrace); err != nil {
+			return ASTNode{}, err
+		}
+		return p.parseMultiSelectHash()
+	}
+	return ASTNode{}, p.syntaxError("Expected identifier, lbracket, or lbrace")
+}
+
+func (p *Parser) parseProjectionRHS(bindingPower int) (ASTNode, error) {
+	current := p.current()
+	if bindingPowers[current] < 10 {
+		return ASTNode{nodeType: ASTIdentity}, nil
+	} else if current == tLbracket {
+		return p.parseExpression(bindingPower)
+	} else if current == tFilter {
+		return p.parseExpression(bindingPower)
+	} else if current == tDot {
+		err := p.match(tDot)
+		if err != nil {
+			return ASTNode{}, err
+		}
+		return p.parseDotRHS(bindingPower)
+	} else {
+		return ASTNode{}, p.syntaxError("Error")
+	}
+}
+
+func (p *Parser) lookahead(number int) tokType {
+	return p.lookaheadToken(number).tokenType
+}
+
+func (p *Parser) current() tokType {
+	return p.lookahead(0)
+}
+
+func (p *Parser) lookaheadToken(number int) token {
+	return p.tokens[p.index+number]
+}
+
+func (p *Parser) advance() {
+	p.index++
+}
+
+func tokensOneOf(elements []tokType, token tokType) bool {
+	for _, elem := range elements {
+		if elem == token {
+			return true
+		}
+	}
+	return false
+}
+
+func (p *Parser) syntaxError(msg string) SyntaxError {
+	return SyntaxError{
+		msg:        msg,
+		Expression: p.expression,
+		Offset:     p.lookaheadToken(0).position,
+	}
+}
+
+// Create a SyntaxError based on the provided token.
+// This differs from syntaxError() which creates a SyntaxError
+// based on the current lookahead token.
+func (p *Parser) syntaxErrorToken(msg string, t token) SyntaxError {
+	return SyntaxError{
+		msg:        msg,
+		Expression: p.expression,
+		Offset:     t.position,
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/toktype_string.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/toktype_string.go
new file mode 100644
index 00000000..dae79cbd
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/toktype_string.go
@@ -0,0 +1,16 @@
+// generated by stringer -type=tokType; DO NOT EDIT
+
+package jmespath
+
+import "fmt"
+
+const _tokType_name = "tUnknowntStartDottFiltertFlattentLparentRparentLbrackettRbrackettLbracetRbracetOrtPipetNumbertUnquotedIdentifiertQuotedIdentifiertCommatColontLTtLTEtGTtGTEtEQtNEtJSONLiteraltStringLiteraltCurrenttExpreftAndtNottEOF"
+
+var _tokType_index = [...]uint8{0, 8, 13, 17, 24, 32, 39, 46, 55, 64, 71, 78, 81, 86, 93, 112, 129, 135, 141, 144, 148, 151, 155, 158, 161, 173, 187, 195, 202, 206, 210, 214}
+
+func (i tokType) String() string {
+	if i < 0 || i >= tokType(len(_tokType_index)-1) {
+		return fmt.Sprintf("tokType(%d)", i)
+	}
+	return _tokType_name[_tokType_index[i]:_tokType_index[i+1]]
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/util.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/util.go
new file mode 100644
index 00000000..ddc1b7d7
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/jmespath/go-jmespath/util.go
@@ -0,0 +1,185 @@
+package jmespath
+
+import (
+	"errors"
+	"reflect"
+)
+
+// IsFalse determines if an object is false based on the JMESPath spec.
+// JMESPath defines false values to be any of:
+// - An empty string array, or hash.
+// - The boolean value false.
+// - nil
+func isFalse(value interface{}) bool {
+	switch v := value.(type) {
+	case bool:
+		return !v
+	case []interface{}:
+		return len(v) == 0
+	case map[string]interface{}:
+		return len(v) == 0
+	case string:
+		return len(v) == 0
+	case nil:
+		return true
+	}
+	// Try the reflection cases before returning false.
+	rv := reflect.ValueOf(value)
+	switch rv.Kind() {
+	case reflect.Struct:
+		// A struct type will never be false, even if
+		// all of its values are the zero type.
+		return false
+	case reflect.Slice, reflect.Map:
+		return rv.Len() == 0
+	case reflect.Ptr:
+		if rv.IsNil() {
+			return true
+		}
+		// If it's a pointer type, we'll try to deref the pointer
+		// and evaluate the pointer value for isFalse.
+		element := rv.Elem()
+		return isFalse(element.Interface())
+	}
+	return false
+}
+
+// ObjsEqual is a generic object equality check.
+// It will take two arbitrary objects and recursively determine
+// if they are equal.
+func objsEqual(left interface{}, right interface{}) bool {
+	return reflect.DeepEqual(left, right)
+}
+
+// SliceParam refers to a single part of a slice.
+// A slice consists of a start, a stop, and a step, similar to
+// python slices.
+type sliceParam struct {
+	N         int
+	Specified bool
+}
+
+// Slice supports [start:stop:step] style slicing that's supported in JMESPath.
+func slice(slice []interface{}, parts []sliceParam) ([]interface{}, error) {
+	computed, err := computeSliceParams(len(slice), parts)
+	if err != nil {
+		return nil, err
+	}
+	start, stop, step := computed[0], computed[1], computed[2]
+	result := []interface{}{}
+	if step > 0 {
+		for i := start; i < stop; i += step {
+			result = append(result, slice[i])
+		}
+	} else {
+		for i := start; i > stop; i += step {
+			result = append(result, slice[i])
+		}
+	}
+	return result, nil
+}
+
+func computeSliceParams(length int, parts []sliceParam) ([]int, error) {
+	var start, stop, step int
+	if !parts[2].Specified {
+		step = 1
+	} else if parts[2].N == 0 {
+		return nil, errors.New("Invalid slice, step cannot be 0")
+	} else {
+		step = parts[2].N
+	}
+	var stepValueNegative bool
+	if step < 0 {
+		stepValueNegative = true
+	} else {
+		stepValueNegative = false
+	}
+
+	if !parts[0].Specified {
+		if stepValueNegative {
+			start = length - 1
+		} else {
+			start = 0
+		}
+	} else {
+		start = capSlice(length, parts[0].N, step)
+	}
+
+	if !parts[1].Specified {
+		if stepValueNegative {
+			stop = -1
+		} else {
+			stop = length
+		}
+	} else {
+		stop = capSlice(length, parts[1].N, step)
+	}
+	return []int{start, stop, step}, nil
+}
+
+func capSlice(length int, actual int, step int) int {
+	if actual < 0 {
+		actual += length
+		if actual < 0 {
+			if step < 0 {
+				actual = -1
+			} else {
+				actual = 0
+			}
+		}
+	} else if actual >= length {
+		if step < 0 {
+			actual = length - 1
+		} else {
+			actual = length
+		}
+	}
+	return actual
+}
+
+// ToArrayNum converts an empty interface type to a slice of float64.
+// If any element in the array cannot be converted, then nil is returned
+// along with a second value of false.
+func toArrayNum(data interface{}) ([]float64, bool) {
+	// Is there a better way to do this with reflect?
+	if d, ok := data.([]interface{}); ok {
+		result := make([]float64, len(d))
+		for i, el := range d {
+			item, ok := el.(float64)
+			if !ok {
+				return nil, false
+			}
+			result[i] = item
+		}
+		return result, true
+	}
+	return nil, false
+}
+
+// ToArrayStr converts an empty interface type to a slice of strings.
+// If any element in the array cannot be converted, then nil is returned
+// along with a second value of false.  If the input data could be entirely
+// converted, then the converted data, along with a second value of true,
+// will be returned.
+func toArrayStr(data interface{}) ([]string, bool) {
+	// Is there a better way to do this with reflect?
+	if d, ok := data.([]interface{}); ok {
+		result := make([]string, len(d))
+		for i, el := range d {
+			item, ok := el.(string)
+			if !ok {
+				return nil, false
+			}
+			result[i] = item
+		}
+		return result, true
+	}
+	return nil, false
+}
+
+func isSliceType(v interface{}) bool {
+	if v == nil {
+		return false
+	}
+	return reflect.TypeOf(v).Kind() == reflect.Slice
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/pkg/errors/.gitignore b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/pkg/errors/.gitignore
new file mode 100644
index 00000000..daf913b1
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/pkg/errors/.gitignore
@@ -0,0 +1,24 @@
+# Compiled Object files, Static and Dynamic libs (Shared Objects)
+*.o
+*.a
+*.so
+
+# Folders
+_obj
+_test
+
+# Architecture specific extensions/prefixes
+*.[568vq]
+[568vq].out
+
+*.cgo1.go
+*.cgo2.c
+_cgo_defun.c
+_cgo_gotypes.go
+_cgo_export.*
+
+_testmain.go
+
+*.exe
+*.test
+*.prof
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/pkg/errors/.travis.yml b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/pkg/errors/.travis.yml
new file mode 100644
index 00000000..d4b92663
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/pkg/errors/.travis.yml
@@ -0,0 +1,15 @@
+language: go
+go_import_path: github.com/pkg/errors
+go:
+  - 1.4.x
+  - 1.5.x
+  - 1.6.x
+  - 1.7.x
+  - 1.8.x
+  - 1.9.x
+  - 1.10.x
+  - 1.11.x
+  - tip
+
+script:
+  - go test -v ./...
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/pkg/errors/LICENSE b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/pkg/errors/LICENSE
new file mode 100644
index 00000000..835ba3e7
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/pkg/errors/LICENSE
@@ -0,0 +1,23 @@
+Copyright (c) 2015, Dave Cheney <dave@cheney.net>
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this
+  list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice,
+  this list of conditions and the following disclaimer in the documentation
+  and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/pkg/errors/README.md b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/pkg/errors/README.md
new file mode 100644
index 00000000..6483ba2a
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/pkg/errors/README.md
@@ -0,0 +1,52 @@
+# errors [![Travis-CI](https://travis-ci.org/pkg/errors.svg)](https://travis-ci.org/pkg/errors) [![AppVeyor](https://ci.appveyor.com/api/projects/status/b98mptawhudj53ep/branch/master?svg=true)](https://ci.appveyor.com/project/davecheney/errors/branch/master) [![GoDoc](https://godoc.org/github.com/pkg/errors?status.svg)](http://godoc.org/github.com/pkg/errors) [![Report card](https://goreportcard.com/badge/github.com/pkg/errors)](https://goreportcard.com/report/github.com/pkg/errors) [![Sourcegraph](https://sourcegraph.com/github.com/pkg/errors/-/badge.svg)](https://sourcegraph.com/github.com/pkg/errors?badge)
+
+Package errors provides simple error handling primitives.
+
+`go get github.com/pkg/errors`
+
+The traditional error handling idiom in Go is roughly akin to
+```go
+if err != nil {
+        return err
+}
+```
+which applied recursively up the call stack results in error reports without context or debugging information. The errors package allows programmers to add context to the failure path in their code in a way that does not destroy the original value of the error.
+
+## Adding context to an error
+
+The errors.Wrap function returns a new error that adds context to the original error. For example
+```go
+_, err := ioutil.ReadAll(r)
+if err != nil {
+        return errors.Wrap(err, "read failed")
+}
+```
+## Retrieving the cause of an error
+
+Using `errors.Wrap` constructs a stack of errors, adding context to the preceding error. Depending on the nature of the error it may be necessary to reverse the operation of errors.Wrap to retrieve the original error for inspection. Any error value which implements this interface can be inspected by `errors.Cause`.
+```go
+type causer interface {
+        Cause() error
+}
+```
+`errors.Cause` will recursively retrieve the topmost error which does not implement `causer`, which is assumed to be the original cause. For example:
+```go
+switch err := errors.Cause(err).(type) {
+case *MyError:
+        // handle specifically
+default:
+        // unknown error
+}
+```
+
+[Read the package documentation for more information](https://godoc.org/github.com/pkg/errors).
+
+## Contributing
+
+We welcome pull requests, bug fixes and issue reports. With that said, the bar for adding new symbols to this package is intentionally set high.
+
+Before proposing a change, please discuss your change by raising an issue.
+
+## License
+
+BSD-2-Clause
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/pkg/errors/appveyor.yml b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/pkg/errors/appveyor.yml
new file mode 100644
index 00000000..a932eade
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/pkg/errors/appveyor.yml
@@ -0,0 +1,32 @@
+version: build-{build}.{branch}
+
+clone_folder: C:\gopath\src\github.com\pkg\errors
+shallow_clone: true # for startup speed
+
+environment:
+  GOPATH: C:\gopath
+
+platform:
+  - x64
+
+# http://www.appveyor.com/docs/installed-software
+install:
+  # some helpful output for debugging builds
+  - go version
+  - go env
+  # pre-installed MinGW at C:\MinGW is 32bit only
+  # but MSYS2 at C:\msys64 has mingw64
+  - set PATH=C:\msys64\mingw64\bin;%PATH%
+  - gcc --version
+  - g++ --version
+
+build_script:
+  - go install -v ./...
+
+test_script:
+  - set PATH=C:\gopath\bin;%PATH%
+  - go test -v ./...
+
+#artifacts:
+#  - path: '%GOPATH%\bin\*.exe'
+deploy: off
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/pkg/errors/errors.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/pkg/errors/errors.go
new file mode 100644
index 00000000..7421f326
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/pkg/errors/errors.go
@@ -0,0 +1,282 @@
+// Package errors provides simple error handling primitives.
+//
+// The traditional error handling idiom in Go is roughly akin to
+//
+//     if err != nil {
+//             return err
+//     }
+//
+// which when applied recursively up the call stack results in error reports
+// without context or debugging information. The errors package allows
+// programmers to add context to the failure path in their code in a way
+// that does not destroy the original value of the error.
+//
+// Adding context to an error
+//
+// The errors.Wrap function returns a new error that adds context to the
+// original error by recording a stack trace at the point Wrap is called,
+// together with the supplied message. For example
+//
+//     _, err := ioutil.ReadAll(r)
+//     if err != nil {
+//             return errors.Wrap(err, "read failed")
+//     }
+//
+// If additional control is required, the errors.WithStack and
+// errors.WithMessage functions destructure errors.Wrap into its component
+// operations: annotating an error with a stack trace and with a message,
+// respectively.
+//
+// Retrieving the cause of an error
+//
+// Using errors.Wrap constructs a stack of errors, adding context to the
+// preceding error. Depending on the nature of the error it may be necessary
+// to reverse the operation of errors.Wrap to retrieve the original error
+// for inspection. Any error value which implements this interface
+//
+//     type causer interface {
+//             Cause() error
+//     }
+//
+// can be inspected by errors.Cause. errors.Cause will recursively retrieve
+// the topmost error that does not implement causer, which is assumed to be
+// the original cause. For example:
+//
+//     switch err := errors.Cause(err).(type) {
+//     case *MyError:
+//             // handle specifically
+//     default:
+//             // unknown error
+//     }
+//
+// Although the causer interface is not exported by this package, it is
+// considered a part of its stable public interface.
+//
+// Formatted printing of errors
+//
+// All error values returned from this package implement fmt.Formatter and can
+// be formatted by the fmt package. The following verbs are supported:
+//
+//     %s    print the error. If the error has a Cause it will be
+//           printed recursively.
+//     %v    see %s
+//     %+v   extended format. Each Frame of the error's StackTrace will
+//           be printed in detail.
+//
+// Retrieving the stack trace of an error or wrapper
+//
+// New, Errorf, Wrap, and Wrapf record a stack trace at the point they are
+// invoked. This information can be retrieved with the following interface:
+//
+//     type stackTracer interface {
+//             StackTrace() errors.StackTrace
+//     }
+//
+// The returned errors.StackTrace type is defined as
+//
+//     type StackTrace []Frame
+//
+// The Frame type represents a call site in the stack trace. Frame supports
+// the fmt.Formatter interface that can be used for printing information about
+// the stack trace of this error. For example:
+//
+//     if err, ok := err.(stackTracer); ok {
+//             for _, f := range err.StackTrace() {
+//                     fmt.Printf("%+s:%d", f)
+//             }
+//     }
+//
+// Although the stackTracer interface is not exported by this package, it is
+// considered a part of its stable public interface.
+//
+// See the documentation for Frame.Format for more details.
+package errors
+
+import (
+	"fmt"
+	"io"
+)
+
+// New returns an error with the supplied message.
+// New also records the stack trace at the point it was called.
+func New(message string) error {
+	return &fundamental{
+		msg:   message,
+		stack: callers(),
+	}
+}
+
+// Errorf formats according to a format specifier and returns the string
+// as a value that satisfies error.
+// Errorf also records the stack trace at the point it was called.
+func Errorf(format string, args ...interface{}) error {
+	return &fundamental{
+		msg:   fmt.Sprintf(format, args...),
+		stack: callers(),
+	}
+}
+
+// fundamental is an error that has a message and a stack, but no caller.
+type fundamental struct {
+	msg string
+	*stack
+}
+
+func (f *fundamental) Error() string { return f.msg }
+
+func (f *fundamental) Format(s fmt.State, verb rune) {
+	switch verb {
+	case 'v':
+		if s.Flag('+') {
+			io.WriteString(s, f.msg)
+			f.stack.Format(s, verb)
+			return
+		}
+		fallthrough
+	case 's':
+		io.WriteString(s, f.msg)
+	case 'q':
+		fmt.Fprintf(s, "%q", f.msg)
+	}
+}
+
+// WithStack annotates err with a stack trace at the point WithStack was called.
+// If err is nil, WithStack returns nil.
+func WithStack(err error) error {
+	if err == nil {
+		return nil
+	}
+	return &withStack{
+		err,
+		callers(),
+	}
+}
+
+type withStack struct {
+	error
+	*stack
+}
+
+func (w *withStack) Cause() error { return w.error }
+
+func (w *withStack) Format(s fmt.State, verb rune) {
+	switch verb {
+	case 'v':
+		if s.Flag('+') {
+			fmt.Fprintf(s, "%+v", w.Cause())
+			w.stack.Format(s, verb)
+			return
+		}
+		fallthrough
+	case 's':
+		io.WriteString(s, w.Error())
+	case 'q':
+		fmt.Fprintf(s, "%q", w.Error())
+	}
+}
+
+// Wrap returns an error annotating err with a stack trace
+// at the point Wrap is called, and the supplied message.
+// If err is nil, Wrap returns nil.
+func Wrap(err error, message string) error {
+	if err == nil {
+		return nil
+	}
+	err = &withMessage{
+		cause: err,
+		msg:   message,
+	}
+	return &withStack{
+		err,
+		callers(),
+	}
+}
+
+// Wrapf returns an error annotating err with a stack trace
+// at the point Wrapf is called, and the format specifier.
+// If err is nil, Wrapf returns nil.
+func Wrapf(err error, format string, args ...interface{}) error {
+	if err == nil {
+		return nil
+	}
+	err = &withMessage{
+		cause: err,
+		msg:   fmt.Sprintf(format, args...),
+	}
+	return &withStack{
+		err,
+		callers(),
+	}
+}
+
+// WithMessage annotates err with a new message.
+// If err is nil, WithMessage returns nil.
+func WithMessage(err error, message string) error {
+	if err == nil {
+		return nil
+	}
+	return &withMessage{
+		cause: err,
+		msg:   message,
+	}
+}
+
+// WithMessagef annotates err with the format specifier.
+// If err is nil, WithMessagef returns nil.
+func WithMessagef(err error, format string, args ...interface{}) error {
+	if err == nil {
+		return nil
+	}
+	return &withMessage{
+		cause: err,
+		msg:   fmt.Sprintf(format, args...),
+	}
+}
+
+type withMessage struct {
+	cause error
+	msg   string
+}
+
+func (w *withMessage) Error() string { return w.msg + ": " + w.cause.Error() }
+func (w *withMessage) Cause() error  { return w.cause }
+
+func (w *withMessage) Format(s fmt.State, verb rune) {
+	switch verb {
+	case 'v':
+		if s.Flag('+') {
+			fmt.Fprintf(s, "%+v\n", w.Cause())
+			io.WriteString(s, w.msg)
+			return
+		}
+		fallthrough
+	case 's', 'q':
+		io.WriteString(s, w.Error())
+	}
+}
+
+// Cause returns the underlying cause of the error, if possible.
+// An error value has a cause if it implements the following
+// interface:
+//
+//     type causer interface {
+//            Cause() error
+//     }
+//
+// If the error does not implement Cause, the original error will
+// be returned. If the error is nil, nil will be returned without further
+// investigation.
+func Cause(err error) error {
+	type causer interface {
+		Cause() error
+	}
+
+	for err != nil {
+		cause, ok := err.(causer)
+		if !ok {
+			break
+		}
+		err = cause.Cause()
+	}
+	return err
+}
diff --git a/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/pkg/errors/stack.go b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/pkg/errors/stack.go
new file mode 100644
index 00000000..2874a048
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/colorteller/vendor/github.com/pkg/errors/stack.go
@@ -0,0 +1,147 @@
+package errors
+
+import (
+	"fmt"
+	"io"
+	"path"
+	"runtime"
+	"strings"
+)
+
+// Frame represents a program counter inside a stack frame.
+type Frame uintptr
+
+// pc returns the program counter for this frame;
+// multiple frames may have the same PC value.
+func (f Frame) pc() uintptr { return uintptr(f) - 1 }
+
+// file returns the full path to the file that contains the
+// function for this Frame's pc.
+func (f Frame) file() string {
+	fn := runtime.FuncForPC(f.pc())
+	if fn == nil {
+		return "unknown"
+	}
+	file, _ := fn.FileLine(f.pc())
+	return file
+}
+
+// line returns the line number of source code of the
+// function for this Frame's pc.
+func (f Frame) line() int {
+	fn := runtime.FuncForPC(f.pc())
+	if fn == nil {
+		return 0
+	}
+	_, line := fn.FileLine(f.pc())
+	return line
+}
+
+// Format formats the frame according to the fmt.Formatter interface.
+//
+//    %s    source file
+//    %d    source line
+//    %n    function name
+//    %v    equivalent to %s:%d
+//
+// Format accepts flags that alter the printing of some verbs, as follows:
+//
+//    %+s   function name and path of source file relative to the compile time
+//          GOPATH separated by \n\t (<funcname>\n\t<path>)
+//    %+v   equivalent to %+s:%d
+func (f Frame) Format(s fmt.State, verb rune) {
+	switch verb {
+	case 's':
+		switch {
+		case s.Flag('+'):
+			pc := f.pc()
+			fn := runtime.FuncForPC(pc)
+			if fn == nil {
+				io.WriteString(s, "unknown")
+			} else {
+				file, _ := fn.FileLine(pc)
+				fmt.Fprintf(s, "%s\n\t%s", fn.Name(), file)
+			}
+		default:
+			io.WriteString(s, path.Base(f.file()))
+		}
+	case 'd':
+		fmt.Fprintf(s, "%d", f.line())
+	case 'n':
+		name := runtime.FuncForPC(f.pc()).Name()
+		io.WriteString(s, funcname(name))
+	case 'v':
+		f.Format(s, 's')
+		io.WriteString(s, ":")
+		f.Format(s, 'd')
+	}
+}
+
+// StackTrace is stack of Frames from innermost (newest) to outermost (oldest).
+type StackTrace []Frame
+
+// Format formats the stack of Frames according to the fmt.Formatter interface.
+//
+//    %s	lists source files for each Frame in the stack
+//    %v	lists the source file and line number for each Frame in the stack
+//
+// Format accepts flags that alter the printing of some verbs, as follows:
+//
+//    %+v   Prints filename, function, and line number for each Frame in the stack.
+func (st StackTrace) Format(s fmt.State, verb rune) {
+	switch verb {
+	case 'v':
+		switch {
+		case s.Flag('+'):
+			for _, f := range st {
+				fmt.Fprintf(s, "\n%+v", f)
+			}
+		case s.Flag('#'):
+			fmt.Fprintf(s, "%#v", []Frame(st))
+		default:
+			fmt.Fprintf(s, "%v", []Frame(st))
+		}
+	case 's':
+		fmt.Fprintf(s, "%s", []Frame(st))
+	}
+}
+
+// stack represents a stack of program counters.
+type stack []uintptr
+
+func (s *stack) Format(st fmt.State, verb rune) {
+	switch verb {
+	case 'v':
+		switch {
+		case st.Flag('+'):
+			for _, pc := range *s {
+				f := Frame(pc)
+				fmt.Fprintf(st, "\n%+v", f)
+			}
+		}
+	}
+}
+
+func (s *stack) StackTrace() StackTrace {
+	f := make([]Frame, len(*s))
+	for i := 0; i < len(f); i++ {
+		f[i] = Frame((*s)[i])
+	}
+	return f
+}
+
+func callers() *stack {
+	const depth = 32
+	var pcs [depth]uintptr
+	n := runtime.Callers(3, pcs[:])
+	var st stack = pcs[0:n]
+	return &st
+}
+
+// funcname removes the path prefix component of a function's name reported by func.Name().
+func funcname(name string) string {
+	i := strings.LastIndex(name, "/")
+	name = name[i+1:]
+	i = strings.Index(name, ".")
+	return name[i+1:]
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/Dockerfile b/walkthroughs/tls-with-acm/src/gateway/Dockerfile
new file mode 100644
index 00000000..fa5fcf5c
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/Dockerfile
@@ -0,0 +1,16 @@
+FROM golang:1.10 AS builder
+
+# Download and install the latest release of dep
+ADD https://github.com/golang/dep/releases/download/v0.4.1/dep-linux-amd64 /usr/bin/dep
+RUN chmod +x /usr/bin/dep
+
+# Copy the code from the host and compile it
+WORKDIR $GOPATH/src/github.com/username/repo
+COPY Gopkg.toml Gopkg.lock ./
+RUN dep ensure --vendor-only
+COPY . ./
+RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix nocgo -o /app .
+
+FROM scratch
+COPY --from=builder /app ./
+ENTRYPOINT ["./app"]
diff --git a/walkthroughs/tls-with-acm/src/gateway/Gopkg.lock b/walkthroughs/tls-with-acm/src/gateway/Gopkg.lock
new file mode 100644
index 00000000..2aa40d0c
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/Gopkg.lock
@@ -0,0 +1,76 @@
+# This file is autogenerated, do not edit; changes may be undone by the next 'dep ensure'.
+
+
+[[projects]]
+  digest = "1:1034326f8d61b0f29e48151b732a24052a223ec859b16dc23a607cb757e9a76b"
+  name = "github.com/aws/aws-sdk-go"
+  packages = [
+    "aws",
+    "aws/awserr",
+    "aws/awsutil",
+    "aws/client",
+    "aws/client/metadata",
+    "aws/corehandlers",
+    "aws/credentials",
+    "aws/ec2metadata",
+    "aws/endpoints",
+    "aws/request",
+    "internal/ini",
+    "internal/sdkio",
+    "internal/sdkrand",
+    "internal/sdkuri",
+    "internal/shareddefaults",
+  ]
+  pruneopts = "UT"
+  revision = "4a2b0831f1351f3ece1962805a88fcc667cedd3e"
+  version = "v1.19.0"
+
+[[projects]]
+  digest = "1:dff8fcd35d7119307681535224fe8834916426cd1b079c42e3b3a17f792348ed"
+  name = "github.com/aws/aws-xray-sdk-go"
+  packages = [
+    "header",
+    "internal/plugins",
+    "pattern",
+    "resources",
+    "strategy/ctxmissing",
+    "strategy/exception",
+    "strategy/sampling",
+    "xray",
+  ]
+  pruneopts = "UT"
+  revision = "32670489212454717deeafb8da5dbb1da0299749"
+  version = "v0.9.4"
+
+[[projects]]
+  digest = "1:50e893a85575fa48dc4982a279e50e2fd8b74e4f7c587860c1e25c77083b8125"
+  name = "github.com/cihub/seelog"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "d2c6e5aa9fbfdd1c624e140287063c7730654115"
+  version = "v2.6"
+
+[[projects]]
+  digest = "1:bb81097a5b62634f3e9fec1014657855610c82d19b9a40c17612e32651e35dca"
+  name = "github.com/jmespath/go-jmespath"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "c2b33e84"
+
+[[projects]]
+  digest = "1:40e195917a951a8bf867cd05de2a46aaf1806c50cf92eebf4c16f78cd196f747"
+  name = "github.com/pkg/errors"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "645ef00459ed84a119197bfb8d8205042c6df63d"
+  version = "v0.8.0"
+
+[solve-meta]
+  analyzer-name = "dep"
+  analyzer-version = 1
+  input-imports = [
+    "github.com/aws/aws-xray-sdk-go/xray",
+    "github.com/pkg/errors",
+  ]
+  solver-name = "gps-cdcl"
+  solver-version = 1
diff --git a/walkthroughs/tls-with-acm/src/gateway/Gopkg.toml b/walkthroughs/tls-with-acm/src/gateway/Gopkg.toml
new file mode 100644
index 00000000..b1ef7441
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/Gopkg.toml
@@ -0,0 +1,34 @@
+# Gopkg.toml example
+#
+# Refer to https://golang.github.io/dep/docs/Gopkg.toml.html
+# for detailed Gopkg.toml documentation.
+#
+# required = ["github.com/user/thing/cmd/thing"]
+# ignored = ["github.com/user/project/pkgX", "bitbucket.org/user/project/pkgA/pkgY"]
+#
+# [[constraint]]
+#   name = "github.com/user/project"
+#   version = "1.0.0"
+#
+# [[constraint]]
+#   name = "github.com/user/project2"
+#   branch = "dev"
+#   source = "github.com/myfork/project2"
+#
+# [[override]]
+#   name = "github.com/x/y"
+#   version = "2.4.0"
+#
+# [prune]
+#   non-go = false
+#   go-tests = true
+#   unused-packages = true
+
+
+[[constraint]]
+  name = "github.com/pkg/errors"
+  version = "0.8.0"
+
+[prune]
+  go-tests = true
+  unused-packages = true
diff --git a/walkthroughs/tls-with-acm/src/gateway/deploy.sh b/walkthroughs/tls-with-acm/src/gateway/deploy.sh
new file mode 100755
index 00000000..7ec7ed8a
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/deploy.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# vim:syn=sh:ts=4:sw=4:et:ai
+
+set -ex
+
+if [ -z $COLOR_GATEWAY_IMAGE ]; then
+    echo "COLOR_GATEWAY_IMAGE environment variable is not set"
+    exit 1
+fi
+
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null && pwd )"
+
+# build
+docker build -t $COLOR_GATEWAY_IMAGE $DIR
+
+# push
+if [ -z $AWS_PROFILE  ]; then
+    $(aws ecr get-login --no-include-email --region $AWS_DEFAULT_REGION)
+else
+    $(aws ecr get-login --no-include-email --region $AWS_DEFAULT_REGION)
+fi
+docker push $COLOR_GATEWAY_IMAGE
diff --git a/walkthroughs/tls-with-acm/src/gateway/main.go b/walkthroughs/tls-with-acm/src/gateway/main.go
new file mode 100644
index 00000000..6f9fb33a
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/main.go
@@ -0,0 +1,225 @@
+package main
+
+import (
+	"bufio"
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"log"
+	"math"
+	"net"
+	"net/http"
+	"os"
+	"strings"
+	"sync"
+
+	"github.com/aws/aws-xray-sdk-go/xray"
+	"github.com/pkg/errors"
+)
+
+const defaultPort = "8080"
+const defaultStage = "default"
+const maxColors = 1000
+
+var colors [maxColors]string
+var colorsIdx int
+var colorsMutext = &sync.Mutex{}
+
+func getServerPort() string {
+	port := os.Getenv("SERVER_PORT")
+	if port != "" {
+		return port
+	}
+
+	return defaultPort
+}
+
+func getStage() string {
+	stage := os.Getenv("STAGE")
+	if stage != "" {
+		return stage
+	}
+
+	return defaultStage
+}
+
+func getColorTellerEndpoint() (string, error) {
+	colorTellerEndpoint := os.Getenv("COLOR_TELLER_ENDPOINT")
+	if colorTellerEndpoint == "" {
+		return "", errors.New("COLOR_TELLER_ENDPOINT is not set")
+	}
+	return colorTellerEndpoint, nil
+}
+
+type colorHandler struct{}
+
+func (h *colorHandler) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
+	color, err := getColorFromColorTeller(request)
+	if err != nil {
+		writer.WriteHeader(http.StatusInternalServerError)
+		writer.Write([]byte("500 - Unexpected Error"))
+		return
+	}
+
+	colorsMutext.Lock()
+	defer colorsMutext.Unlock()
+
+	addColor(color)
+	statsJson, err := json.Marshal(getRatios())
+	if err != nil {
+		fmt.Fprintf(writer, `{"color":"%s", "error":"%s"}`, color, err)
+		return
+	}
+	fmt.Fprintf(writer, `{"color":"%s", "stats": %s}`, color, statsJson)
+}
+
+func addColor(color string) {
+	colors[colorsIdx] = color
+
+	colorsIdx += 1
+	if colorsIdx >= maxColors {
+		colorsIdx = 0
+	}
+}
+
+func getRatios() map[string]float64 {
+	counts := make(map[string]int)
+	var total = 0
+
+	for _, c := range colors {
+		if c != "" {
+			counts[c] += 1
+			total += 1
+		}
+	}
+
+	ratios := make(map[string]float64)
+	for k, v := range counts {
+		ratio := float64(v) / float64(total)
+		ratios[k] = math.Round(ratio*100) / 100
+	}
+
+	return ratios
+}
+
+type clearColorStatsHandler struct{}
+
+func (h *clearColorStatsHandler) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
+	colorsMutext.Lock()
+	defer colorsMutext.Unlock()
+
+	colorsIdx = 0
+	for i := range colors {
+		colors[i] = ""
+	}
+
+	fmt.Fprint(writer, "cleared")
+}
+
+func getColorFromColorTeller(request *http.Request) (string, error) {
+	colorTellerEndpoint, err := getColorTellerEndpoint()
+	if err != nil {
+		return "-n/a-", err
+	}
+
+	client := xray.Client(&http.Client{})
+	req, err := http.NewRequest(http.MethodGet, fmt.Sprintf("http://%s", colorTellerEndpoint), nil)
+	if err != nil {
+		return "-n/a-", err
+	}
+
+	resp, err := client.Do(req.WithContext(request.Context()))
+	if err != nil {
+		return "-n/a-", err
+	}
+
+	defer resp.Body.Close()
+	body, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return "-n/a-", err
+	}
+
+	color := strings.TrimSpace(string(body))
+	if len(color) < 1 {
+		return "-n/a-", errors.New("Empty response from colorTeller")
+	}
+
+	return color, nil
+}
+
+func getTCPEchoEndpoint() (string, error) {
+	tcpEchoEndpoint := os.Getenv("TCP_ECHO_ENDPOINT")
+	if tcpEchoEndpoint == "" {
+		return "", errors.New("TCP_ECHO_ENDPOINT is not set")
+	}
+	return tcpEchoEndpoint, nil
+}
+
+type tcpEchoHandler struct{}
+
+func (h *tcpEchoHandler) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
+	endpoint, err := getTCPEchoEndpoint()
+	if err != nil {
+		writer.WriteHeader(http.StatusInternalServerError)
+		fmt.Fprintf(writer, "tcpecho endpoint is not set")
+		return
+	}
+
+	log.Printf("Dialing tcp endpoint %s", endpoint)
+	conn, err := net.Dial("tcp", endpoint)
+	if err != nil {
+		writer.WriteHeader(http.StatusInternalServerError)
+		fmt.Fprintf(writer, "Dial failed, err:%s", err.Error())
+		return
+	}
+	defer conn.Close()
+
+	strEcho := "Hello from gateway"
+	log.Printf("Writing '%s'", strEcho)
+	_, err = fmt.Fprintf(conn, strEcho)
+	if err != nil {
+		writer.WriteHeader(http.StatusInternalServerError)
+		fmt.Fprintf(writer, "Write to server failed, err:%s", err.Error())
+		return
+	}
+
+	reply, err := bufio.NewReader(conn).ReadString('\n')
+	if err != nil {
+		writer.WriteHeader(http.StatusInternalServerError)
+		fmt.Fprintf(writer, "Read from server failed, err:%s", err.Error())
+		return
+	}
+
+	fmt.Fprintf(writer, "Response from tcpecho server: %s", reply)
+}
+
+type pingHandler struct{}
+
+func (h *pingHandler) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
+	log.Println("ping requested, reponding with HTTP 200")
+	writer.WriteHeader(http.StatusOK)
+}
+
+func main() {
+	log.Println("Starting server, listening on port " + getServerPort())
+
+	colorTellerEndpoint, err := getColorTellerEndpoint()
+	if err != nil {
+		log.Fatalln(err)
+	}
+	tcpEchoEndpoint, err := getTCPEchoEndpoint()
+	if err != nil {
+		log.Println(err)
+	}
+
+	log.Println("Using color-teller at " + colorTellerEndpoint)
+	log.Println("Using tcp-echo at " + tcpEchoEndpoint)
+
+	xraySegmentNamer := xray.NewFixedSegmentNamer(fmt.Sprintf("%s-gateway", getStage()))
+
+	http.Handle("/color", xray.Handler(xraySegmentNamer, &colorHandler{}))
+	http.Handle("/color/clear", xray.Handler(xraySegmentNamer, &clearColorStatsHandler{}))
+	http.Handle("/tcpecho", xray.Handler(xraySegmentNamer, &tcpEchoHandler{}))
+	http.Handle("/ping", xray.Handler(xraySegmentNamer, &pingHandler{}))
+	log.Fatal(http.ListenAndServe(":"+getServerPort(), nil))
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/LICENSE.txt b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/LICENSE.txt
new file mode 100644
index 00000000..d6456956
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/LICENSE.txt
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/NOTICE.txt b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/NOTICE.txt
new file mode 100644
index 00000000..899129ec
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/NOTICE.txt
@@ -0,0 +1,3 @@
+AWS SDK for Go
+Copyright 2015 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+Copyright 2014-2015 Stripe, Inc.
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/awserr/error.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/awserr/error.go
new file mode 100644
index 00000000..56fdfc2b
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/awserr/error.go
@@ -0,0 +1,145 @@
+// Package awserr represents API error interface accessors for the SDK.
+package awserr
+
+// An Error wraps lower level errors with code, message and an original error.
+// The underlying concrete error type may also satisfy other interfaces which
+// can be to used to obtain more specific information about the error.
+//
+// Calling Error() or String() will always include the full information about
+// an error based on its underlying type.
+//
+// Example:
+//
+//     output, err := s3manage.Upload(svc, input, opts)
+//     if err != nil {
+//         if awsErr, ok := err.(awserr.Error); ok {
+//             // Get error details
+//             log.Println("Error:", awsErr.Code(), awsErr.Message())
+//
+//             // Prints out full error message, including original error if there was one.
+//             log.Println("Error:", awsErr.Error())
+//
+//             // Get original error
+//             if origErr := awsErr.OrigErr(); origErr != nil {
+//                 // operate on original error.
+//             }
+//         } else {
+//             fmt.Println(err.Error())
+//         }
+//     }
+//
+type Error interface {
+	// Satisfy the generic error interface.
+	error
+
+	// Returns the short phrase depicting the classification of the error.
+	Code() string
+
+	// Returns the error details message.
+	Message() string
+
+	// Returns the original error if one was set.  Nil is returned if not set.
+	OrigErr() error
+}
+
+// BatchError is a batch of errors which also wraps lower level errors with
+// code, message, and original errors. Calling Error() will include all errors
+// that occurred in the batch.
+//
+// Deprecated: Replaced with BatchedErrors. Only defined for backwards
+// compatibility.
+type BatchError interface {
+	// Satisfy the generic error interface.
+	error
+
+	// Returns the short phrase depicting the classification of the error.
+	Code() string
+
+	// Returns the error details message.
+	Message() string
+
+	// Returns the original error if one was set.  Nil is returned if not set.
+	OrigErrs() []error
+}
+
+// BatchedErrors is a batch of errors which also wraps lower level errors with
+// code, message, and original errors. Calling Error() will include all errors
+// that occurred in the batch.
+//
+// Replaces BatchError
+type BatchedErrors interface {
+	// Satisfy the base Error interface.
+	Error
+
+	// Returns the original error if one was set.  Nil is returned if not set.
+	OrigErrs() []error
+}
+
+// New returns an Error object described by the code, message, and origErr.
+//
+// If origErr satisfies the Error interface it will not be wrapped within a new
+// Error object and will instead be returned.
+func New(code, message string, origErr error) Error {
+	var errs []error
+	if origErr != nil {
+		errs = append(errs, origErr)
+	}
+	return newBaseError(code, message, errs)
+}
+
+// NewBatchError returns an BatchedErrors with a collection of errors as an
+// array of errors.
+func NewBatchError(code, message string, errs []error) BatchedErrors {
+	return newBaseError(code, message, errs)
+}
+
+// A RequestFailure is an interface to extract request failure information from
+// an Error such as the request ID of the failed request returned by a service.
+// RequestFailures may not always have a requestID value if the request failed
+// prior to reaching the service such as a connection error.
+//
+// Example:
+//
+//     output, err := s3manage.Upload(svc, input, opts)
+//     if err != nil {
+//         if reqerr, ok := err.(RequestFailure); ok {
+//             log.Println("Request failed", reqerr.Code(), reqerr.Message(), reqerr.RequestID())
+//         } else {
+//             log.Println("Error:", err.Error())
+//         }
+//     }
+//
+// Combined with awserr.Error:
+//
+//    output, err := s3manage.Upload(svc, input, opts)
+//    if err != nil {
+//        if awsErr, ok := err.(awserr.Error); ok {
+//            // Generic AWS Error with Code, Message, and original error (if any)
+//            fmt.Println(awsErr.Code(), awsErr.Message(), awsErr.OrigErr())
+//
+//            if reqErr, ok := err.(awserr.RequestFailure); ok {
+//                // A service error occurred
+//                fmt.Println(reqErr.StatusCode(), reqErr.RequestID())
+//            }
+//        } else {
+//            fmt.Println(err.Error())
+//        }
+//    }
+//
+type RequestFailure interface {
+	Error
+
+	// The status code of the HTTP response.
+	StatusCode() int
+
+	// The request ID returned by the service for a request failure. This will
+	// be empty if no request ID is available such as the request failed due
+	// to a connection error.
+	RequestID() string
+}
+
+// NewRequestFailure returns a new request error wrapper for the given Error
+// provided.
+func NewRequestFailure(err Error, statusCode int, reqID string) RequestFailure {
+	return newRequestError(err, statusCode, reqID)
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/awserr/types.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/awserr/types.go
new file mode 100644
index 00000000..0202a008
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/awserr/types.go
@@ -0,0 +1,194 @@
+package awserr
+
+import "fmt"
+
+// SprintError returns a string of the formatted error code.
+//
+// Both extra and origErr are optional.  If they are included their lines
+// will be added, but if they are not included their lines will be ignored.
+func SprintError(code, message, extra string, origErr error) string {
+	msg := fmt.Sprintf("%s: %s", code, message)
+	if extra != "" {
+		msg = fmt.Sprintf("%s\n\t%s", msg, extra)
+	}
+	if origErr != nil {
+		msg = fmt.Sprintf("%s\ncaused by: %s", msg, origErr.Error())
+	}
+	return msg
+}
+
+// A baseError wraps the code and message which defines an error. It also
+// can be used to wrap an original error object.
+//
+// Should be used as the root for errors satisfying the awserr.Error. Also
+// for any error which does not fit into a specific error wrapper type.
+type baseError struct {
+	// Classification of error
+	code string
+
+	// Detailed information about error
+	message string
+
+	// Optional original error this error is based off of. Allows building
+	// chained errors.
+	errs []error
+}
+
+// newBaseError returns an error object for the code, message, and errors.
+//
+// code is a short no whitespace phrase depicting the classification of
+// the error that is being created.
+//
+// message is the free flow string containing detailed information about the
+// error.
+//
+// origErrs is the error objects which will be nested under the new errors to
+// be returned.
+func newBaseError(code, message string, origErrs []error) *baseError {
+	b := &baseError{
+		code:    code,
+		message: message,
+		errs:    origErrs,
+	}
+
+	return b
+}
+
+// Error returns the string representation of the error.
+//
+// See ErrorWithExtra for formatting.
+//
+// Satisfies the error interface.
+func (b baseError) Error() string {
+	size := len(b.errs)
+	if size > 0 {
+		return SprintError(b.code, b.message, "", errorList(b.errs))
+	}
+
+	return SprintError(b.code, b.message, "", nil)
+}
+
+// String returns the string representation of the error.
+// Alias for Error to satisfy the stringer interface.
+func (b baseError) String() string {
+	return b.Error()
+}
+
+// Code returns the short phrase depicting the classification of the error.
+func (b baseError) Code() string {
+	return b.code
+}
+
+// Message returns the error details message.
+func (b baseError) Message() string {
+	return b.message
+}
+
+// OrigErr returns the original error if one was set. Nil is returned if no
+// error was set. This only returns the first element in the list. If the full
+// list is needed, use BatchedErrors.
+func (b baseError) OrigErr() error {
+	switch len(b.errs) {
+	case 0:
+		return nil
+	case 1:
+		return b.errs[0]
+	default:
+		if err, ok := b.errs[0].(Error); ok {
+			return NewBatchError(err.Code(), err.Message(), b.errs[1:])
+		}
+		return NewBatchError("BatchedErrors",
+			"multiple errors occurred", b.errs)
+	}
+}
+
+// OrigErrs returns the original errors if one was set. An empty slice is
+// returned if no error was set.
+func (b baseError) OrigErrs() []error {
+	return b.errs
+}
+
+// So that the Error interface type can be included as an anonymous field
+// in the requestError struct and not conflict with the error.Error() method.
+type awsError Error
+
+// A requestError wraps a request or service error.
+//
+// Composed of baseError for code, message, and original error.
+type requestError struct {
+	awsError
+	statusCode int
+	requestID  string
+}
+
+// newRequestError returns a wrapped error with additional information for
+// request status code, and service requestID.
+//
+// Should be used to wrap all request which involve service requests. Even if
+// the request failed without a service response, but had an HTTP status code
+// that may be meaningful.
+//
+// Also wraps original errors via the baseError.
+func newRequestError(err Error, statusCode int, requestID string) *requestError {
+	return &requestError{
+		awsError:   err,
+		statusCode: statusCode,
+		requestID:  requestID,
+	}
+}
+
+// Error returns the string representation of the error.
+// Satisfies the error interface.
+func (r requestError) Error() string {
+	extra := fmt.Sprintf("status code: %d, request id: %s",
+		r.statusCode, r.requestID)
+	return SprintError(r.Code(), r.Message(), extra, r.OrigErr())
+}
+
+// String returns the string representation of the error.
+// Alias for Error to satisfy the stringer interface.
+func (r requestError) String() string {
+	return r.Error()
+}
+
+// StatusCode returns the wrapped status code for the error
+func (r requestError) StatusCode() int {
+	return r.statusCode
+}
+
+// RequestID returns the wrapped requestID
+func (r requestError) RequestID() string {
+	return r.requestID
+}
+
+// OrigErrs returns the original errors if one was set. An empty slice is
+// returned if no error was set.
+func (r requestError) OrigErrs() []error {
+	if b, ok := r.awsError.(BatchedErrors); ok {
+		return b.OrigErrs()
+	}
+	return []error{r.OrigErr()}
+}
+
+// An error list that satisfies the golang interface
+type errorList []error
+
+// Error returns the string representation of the error.
+//
+// Satisfies the error interface.
+func (e errorList) Error() string {
+	msg := ""
+	// How do we want to handle the array size being zero
+	if size := len(e); size > 0 {
+		for i := 0; i < size; i++ {
+			msg += fmt.Sprintf("%s", e[i].Error())
+			// We check the next index to see if it is within the slice.
+			// If it is, then we append a newline. We do this, because unit tests
+			// could be broken with the additional '\n'
+			if i+1 < size {
+				msg += "\n"
+			}
+		}
+	}
+	return msg
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/awsutil/copy.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/awsutil/copy.go
new file mode 100644
index 00000000..1a3d106d
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/awsutil/copy.go
@@ -0,0 +1,108 @@
+package awsutil
+
+import (
+	"io"
+	"reflect"
+	"time"
+)
+
+// Copy deeply copies a src structure to dst. Useful for copying request and
+// response structures.
+//
+// Can copy between structs of different type, but will only copy fields which
+// are assignable, and exist in both structs. Fields which are not assignable,
+// or do not exist in both structs are ignored.
+func Copy(dst, src interface{}) {
+	dstval := reflect.ValueOf(dst)
+	if !dstval.IsValid() {
+		panic("Copy dst cannot be nil")
+	}
+
+	rcopy(dstval, reflect.ValueOf(src), true)
+}
+
+// CopyOf returns a copy of src while also allocating the memory for dst.
+// src must be a pointer type or this operation will fail.
+func CopyOf(src interface{}) (dst interface{}) {
+	dsti := reflect.New(reflect.TypeOf(src).Elem())
+	dst = dsti.Interface()
+	rcopy(dsti, reflect.ValueOf(src), true)
+	return
+}
+
+// rcopy performs a recursive copy of values from the source to destination.
+//
+// root is used to skip certain aspects of the copy which are not valid
+// for the root node of a object.
+func rcopy(dst, src reflect.Value, root bool) {
+	if !src.IsValid() {
+		return
+	}
+
+	switch src.Kind() {
+	case reflect.Ptr:
+		if _, ok := src.Interface().(io.Reader); ok {
+			if dst.Kind() == reflect.Ptr && dst.Elem().CanSet() {
+				dst.Elem().Set(src)
+			} else if dst.CanSet() {
+				dst.Set(src)
+			}
+		} else {
+			e := src.Type().Elem()
+			if dst.CanSet() && !src.IsNil() {
+				if _, ok := src.Interface().(*time.Time); !ok {
+					dst.Set(reflect.New(e))
+				} else {
+					tempValue := reflect.New(e)
+					tempValue.Elem().Set(src.Elem())
+					// Sets time.Time's unexported values
+					dst.Set(tempValue)
+				}
+			}
+			if src.Elem().IsValid() {
+				// Keep the current root state since the depth hasn't changed
+				rcopy(dst.Elem(), src.Elem(), root)
+			}
+		}
+	case reflect.Struct:
+		t := dst.Type()
+		for i := 0; i < t.NumField(); i++ {
+			name := t.Field(i).Name
+			srcVal := src.FieldByName(name)
+			dstVal := dst.FieldByName(name)
+			if srcVal.IsValid() && dstVal.CanSet() {
+				rcopy(dstVal, srcVal, false)
+			}
+		}
+	case reflect.Slice:
+		if src.IsNil() {
+			break
+		}
+
+		s := reflect.MakeSlice(src.Type(), src.Len(), src.Cap())
+		dst.Set(s)
+		for i := 0; i < src.Len(); i++ {
+			rcopy(dst.Index(i), src.Index(i), false)
+		}
+	case reflect.Map:
+		if src.IsNil() {
+			break
+		}
+
+		s := reflect.MakeMap(src.Type())
+		dst.Set(s)
+		for _, k := range src.MapKeys() {
+			v := src.MapIndex(k)
+			v2 := reflect.New(v.Type()).Elem()
+			rcopy(v2, v, false)
+			dst.SetMapIndex(k, v2)
+		}
+	default:
+		// Assign the value if possible. If its not assignable, the value would
+		// need to be converted and the impact of that may be unexpected, or is
+		// not compatible with the dst type.
+		if src.Type().AssignableTo(dst.Type()) {
+			dst.Set(src)
+		}
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/awsutil/equal.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/awsutil/equal.go
new file mode 100644
index 00000000..59fa4a55
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/awsutil/equal.go
@@ -0,0 +1,27 @@
+package awsutil
+
+import (
+	"reflect"
+)
+
+// DeepEqual returns if the two values are deeply equal like reflect.DeepEqual.
+// In addition to this, this method will also dereference the input values if
+// possible so the DeepEqual performed will not fail if one parameter is a
+// pointer and the other is not.
+//
+// DeepEqual will not perform indirection of nested values of the input parameters.
+func DeepEqual(a, b interface{}) bool {
+	ra := reflect.Indirect(reflect.ValueOf(a))
+	rb := reflect.Indirect(reflect.ValueOf(b))
+
+	if raValid, rbValid := ra.IsValid(), rb.IsValid(); !raValid && !rbValid {
+		// If the elements are both nil, and of the same type the are equal
+		// If they are of different types they are not equal
+		return reflect.TypeOf(a) == reflect.TypeOf(b)
+	} else if raValid != rbValid {
+		// Both values must be valid to be equal
+		return false
+	}
+
+	return reflect.DeepEqual(ra.Interface(), rb.Interface())
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/awsutil/path_value.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/awsutil/path_value.go
new file mode 100644
index 00000000..11c52c38
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/awsutil/path_value.go
@@ -0,0 +1,222 @@
+package awsutil
+
+import (
+	"reflect"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"github.com/jmespath/go-jmespath"
+)
+
+var indexRe = regexp.MustCompile(`(.+)\[(-?\d+)?\]$`)
+
+// rValuesAtPath returns a slice of values found in value v. The values
+// in v are explored recursively so all nested values are collected.
+func rValuesAtPath(v interface{}, path string, createPath, caseSensitive, nilTerm bool) []reflect.Value {
+	pathparts := strings.Split(path, "||")
+	if len(pathparts) > 1 {
+		for _, pathpart := range pathparts {
+			vals := rValuesAtPath(v, pathpart, createPath, caseSensitive, nilTerm)
+			if len(vals) > 0 {
+				return vals
+			}
+		}
+		return nil
+	}
+
+	values := []reflect.Value{reflect.Indirect(reflect.ValueOf(v))}
+	components := strings.Split(path, ".")
+	for len(values) > 0 && len(components) > 0 {
+		var index *int64
+		var indexStar bool
+		c := strings.TrimSpace(components[0])
+		if c == "" { // no actual component, illegal syntax
+			return nil
+		} else if caseSensitive && c != "*" && strings.ToLower(c[0:1]) == c[0:1] {
+			// TODO normalize case for user
+			return nil // don't support unexported fields
+		}
+
+		// parse this component
+		if m := indexRe.FindStringSubmatch(c); m != nil {
+			c = m[1]
+			if m[2] == "" {
+				index = nil
+				indexStar = true
+			} else {
+				i, _ := strconv.ParseInt(m[2], 10, 32)
+				index = &i
+				indexStar = false
+			}
+		}
+
+		nextvals := []reflect.Value{}
+		for _, value := range values {
+			// pull component name out of struct member
+			if value.Kind() != reflect.Struct {
+				continue
+			}
+
+			if c == "*" { // pull all members
+				for i := 0; i < value.NumField(); i++ {
+					if f := reflect.Indirect(value.Field(i)); f.IsValid() {
+						nextvals = append(nextvals, f)
+					}
+				}
+				continue
+			}
+
+			value = value.FieldByNameFunc(func(name string) bool {
+				if c == name {
+					return true
+				} else if !caseSensitive && strings.ToLower(name) == strings.ToLower(c) {
+					return true
+				}
+				return false
+			})
+
+			if nilTerm && value.Kind() == reflect.Ptr && len(components[1:]) == 0 {
+				if !value.IsNil() {
+					value.Set(reflect.Zero(value.Type()))
+				}
+				return []reflect.Value{value}
+			}
+
+			if createPath && value.Kind() == reflect.Ptr && value.IsNil() {
+				// TODO if the value is the terminus it should not be created
+				// if the value to be set to its position is nil.
+				value.Set(reflect.New(value.Type().Elem()))
+				value = value.Elem()
+			} else {
+				value = reflect.Indirect(value)
+			}
+
+			if value.Kind() == reflect.Slice || value.Kind() == reflect.Map {
+				if !createPath && value.IsNil() {
+					value = reflect.ValueOf(nil)
+				}
+			}
+
+			if value.IsValid() {
+				nextvals = append(nextvals, value)
+			}
+		}
+		values = nextvals
+
+		if indexStar || index != nil {
+			nextvals = []reflect.Value{}
+			for _, valItem := range values {
+				value := reflect.Indirect(valItem)
+				if value.Kind() != reflect.Slice {
+					continue
+				}
+
+				if indexStar { // grab all indices
+					for i := 0; i < value.Len(); i++ {
+						idx := reflect.Indirect(value.Index(i))
+						if idx.IsValid() {
+							nextvals = append(nextvals, idx)
+						}
+					}
+					continue
+				}
+
+				// pull out index
+				i := int(*index)
+				if i >= value.Len() { // check out of bounds
+					if createPath {
+						// TODO resize slice
+					} else {
+						continue
+					}
+				} else if i < 0 { // support negative indexing
+					i = value.Len() + i
+				}
+				value = reflect.Indirect(value.Index(i))
+
+				if value.Kind() == reflect.Slice || value.Kind() == reflect.Map {
+					if !createPath && value.IsNil() {
+						value = reflect.ValueOf(nil)
+					}
+				}
+
+				if value.IsValid() {
+					nextvals = append(nextvals, value)
+				}
+			}
+			values = nextvals
+		}
+
+		components = components[1:]
+	}
+	return values
+}
+
+// ValuesAtPath returns a list of values at the case insensitive lexical
+// path inside of a structure.
+func ValuesAtPath(i interface{}, path string) ([]interface{}, error) {
+	result, err := jmespath.Search(path, i)
+	if err != nil {
+		return nil, err
+	}
+
+	v := reflect.ValueOf(result)
+	if !v.IsValid() || (v.Kind() == reflect.Ptr && v.IsNil()) {
+		return nil, nil
+	}
+	if s, ok := result.([]interface{}); ok {
+		return s, err
+	}
+	if v.Kind() == reflect.Map && v.Len() == 0 {
+		return nil, nil
+	}
+	if v.Kind() == reflect.Slice {
+		out := make([]interface{}, v.Len())
+		for i := 0; i < v.Len(); i++ {
+			out[i] = v.Index(i).Interface()
+		}
+		return out, nil
+	}
+
+	return []interface{}{result}, nil
+}
+
+// SetValueAtPath sets a value at the case insensitive lexical path inside
+// of a structure.
+func SetValueAtPath(i interface{}, path string, v interface{}) {
+	if rvals := rValuesAtPath(i, path, true, false, v == nil); rvals != nil {
+		for _, rval := range rvals {
+			if rval.Kind() == reflect.Ptr && rval.IsNil() {
+				continue
+			}
+			setValue(rval, v)
+		}
+	}
+}
+
+func setValue(dstVal reflect.Value, src interface{}) {
+	if dstVal.Kind() == reflect.Ptr {
+		dstVal = reflect.Indirect(dstVal)
+	}
+	srcVal := reflect.ValueOf(src)
+
+	if !srcVal.IsValid() { // src is literal nil
+		if dstVal.CanAddr() {
+			// Convert to pointer so that pointer's value can be nil'ed
+			//                     dstVal = dstVal.Addr()
+		}
+		dstVal.Set(reflect.Zero(dstVal.Type()))
+
+	} else if srcVal.Kind() == reflect.Ptr {
+		if srcVal.IsNil() {
+			srcVal = reflect.Zero(dstVal.Type())
+		} else {
+			srcVal = reflect.ValueOf(src).Elem()
+		}
+		dstVal.Set(srcVal)
+	} else {
+		dstVal.Set(srcVal)
+	}
+
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/awsutil/prettify.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/awsutil/prettify.go
new file mode 100644
index 00000000..710eb432
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/awsutil/prettify.go
@@ -0,0 +1,113 @@
+package awsutil
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"reflect"
+	"strings"
+)
+
+// Prettify returns the string representation of a value.
+func Prettify(i interface{}) string {
+	var buf bytes.Buffer
+	prettify(reflect.ValueOf(i), 0, &buf)
+	return buf.String()
+}
+
+// prettify will recursively walk value v to build a textual
+// representation of the value.
+func prettify(v reflect.Value, indent int, buf *bytes.Buffer) {
+	for v.Kind() == reflect.Ptr {
+		v = v.Elem()
+	}
+
+	switch v.Kind() {
+	case reflect.Struct:
+		strtype := v.Type().String()
+		if strtype == "time.Time" {
+			fmt.Fprintf(buf, "%s", v.Interface())
+			break
+		} else if strings.HasPrefix(strtype, "io.") {
+			buf.WriteString("<buffer>")
+			break
+		}
+
+		buf.WriteString("{\n")
+
+		names := []string{}
+		for i := 0; i < v.Type().NumField(); i++ {
+			name := v.Type().Field(i).Name
+			f := v.Field(i)
+			if name[0:1] == strings.ToLower(name[0:1]) {
+				continue // ignore unexported fields
+			}
+			if (f.Kind() == reflect.Ptr || f.Kind() == reflect.Slice || f.Kind() == reflect.Map) && f.IsNil() {
+				continue // ignore unset fields
+			}
+			names = append(names, name)
+		}
+
+		for i, n := range names {
+			val := v.FieldByName(n)
+			buf.WriteString(strings.Repeat(" ", indent+2))
+			buf.WriteString(n + ": ")
+			prettify(val, indent+2, buf)
+
+			if i < len(names)-1 {
+				buf.WriteString(",\n")
+			}
+		}
+
+		buf.WriteString("\n" + strings.Repeat(" ", indent) + "}")
+	case reflect.Slice:
+		strtype := v.Type().String()
+		if strtype == "[]uint8" {
+			fmt.Fprintf(buf, "<binary> len %d", v.Len())
+			break
+		}
+
+		nl, id, id2 := "", "", ""
+		if v.Len() > 3 {
+			nl, id, id2 = "\n", strings.Repeat(" ", indent), strings.Repeat(" ", indent+2)
+		}
+		buf.WriteString("[" + nl)
+		for i := 0; i < v.Len(); i++ {
+			buf.WriteString(id2)
+			prettify(v.Index(i), indent+2, buf)
+
+			if i < v.Len()-1 {
+				buf.WriteString("," + nl)
+			}
+		}
+
+		buf.WriteString(nl + id + "]")
+	case reflect.Map:
+		buf.WriteString("{\n")
+
+		for i, k := range v.MapKeys() {
+			buf.WriteString(strings.Repeat(" ", indent+2))
+			buf.WriteString(k.String() + ": ")
+			prettify(v.MapIndex(k), indent+2, buf)
+
+			if i < v.Len()-1 {
+				buf.WriteString(",\n")
+			}
+		}
+
+		buf.WriteString("\n" + strings.Repeat(" ", indent) + "}")
+	default:
+		if !v.IsValid() {
+			fmt.Fprint(buf, "<invalid value>")
+			return
+		}
+		format := "%v"
+		switch v.Interface().(type) {
+		case string:
+			format = "%q"
+		case io.ReadSeeker, io.Reader:
+			format = "buffer(%p)"
+		}
+		fmt.Fprintf(buf, format, v.Interface())
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/awsutil/string_value.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/awsutil/string_value.go
new file mode 100644
index 00000000..645df245
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/awsutil/string_value.go
@@ -0,0 +1,88 @@
+package awsutil
+
+import (
+	"bytes"
+	"fmt"
+	"reflect"
+	"strings"
+)
+
+// StringValue returns the string representation of a value.
+func StringValue(i interface{}) string {
+	var buf bytes.Buffer
+	stringValue(reflect.ValueOf(i), 0, &buf)
+	return buf.String()
+}
+
+func stringValue(v reflect.Value, indent int, buf *bytes.Buffer) {
+	for v.Kind() == reflect.Ptr {
+		v = v.Elem()
+	}
+
+	switch v.Kind() {
+	case reflect.Struct:
+		buf.WriteString("{\n")
+
+		for i := 0; i < v.Type().NumField(); i++ {
+			ft := v.Type().Field(i)
+			fv := v.Field(i)
+
+			if ft.Name[0:1] == strings.ToLower(ft.Name[0:1]) {
+				continue // ignore unexported fields
+			}
+			if (fv.Kind() == reflect.Ptr || fv.Kind() == reflect.Slice) && fv.IsNil() {
+				continue // ignore unset fields
+			}
+
+			buf.WriteString(strings.Repeat(" ", indent+2))
+			buf.WriteString(ft.Name + ": ")
+
+			if tag := ft.Tag.Get("sensitive"); tag == "true" {
+				buf.WriteString("<sensitive>")
+			} else {
+				stringValue(fv, indent+2, buf)
+			}
+
+			buf.WriteString(",\n")
+		}
+
+		buf.WriteString("\n" + strings.Repeat(" ", indent) + "}")
+	case reflect.Slice:
+		nl, id, id2 := "", "", ""
+		if v.Len() > 3 {
+			nl, id, id2 = "\n", strings.Repeat(" ", indent), strings.Repeat(" ", indent+2)
+		}
+		buf.WriteString("[" + nl)
+		for i := 0; i < v.Len(); i++ {
+			buf.WriteString(id2)
+			stringValue(v.Index(i), indent+2, buf)
+
+			if i < v.Len()-1 {
+				buf.WriteString("," + nl)
+			}
+		}
+
+		buf.WriteString(nl + id + "]")
+	case reflect.Map:
+		buf.WriteString("{\n")
+
+		for i, k := range v.MapKeys() {
+			buf.WriteString(strings.Repeat(" ", indent+2))
+			buf.WriteString(k.String() + ": ")
+			stringValue(v.MapIndex(k), indent+2, buf)
+
+			if i < v.Len()-1 {
+				buf.WriteString(",\n")
+			}
+		}
+
+		buf.WriteString("\n" + strings.Repeat(" ", indent) + "}")
+	default:
+		format := "%v"
+		switch v.Interface().(type) {
+		case string:
+			format = "%q"
+		}
+		fmt.Fprintf(buf, format, v.Interface())
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/client/client.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/client/client.go
new file mode 100644
index 00000000..70960538
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/client/client.go
@@ -0,0 +1,96 @@
+package client
+
+import (
+	"fmt"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/client/metadata"
+	"github.com/aws/aws-sdk-go/aws/request"
+)
+
+// A Config provides configuration to a service client instance.
+type Config struct {
+	Config        *aws.Config
+	Handlers      request.Handlers
+	Endpoint      string
+	SigningRegion string
+	SigningName   string
+
+	// States that the signing name did not come from a modeled source but
+	// was derived based on other data. Used by service client constructors
+	// to determine if the signin name can be overridden based on metadata the
+	// service has.
+	SigningNameDerived bool
+}
+
+// ConfigProvider provides a generic way for a service client to receive
+// the ClientConfig without circular dependencies.
+type ConfigProvider interface {
+	ClientConfig(serviceName string, cfgs ...*aws.Config) Config
+}
+
+// ConfigNoResolveEndpointProvider same as ConfigProvider except it will not
+// resolve the endpoint automatically. The service client's endpoint must be
+// provided via the aws.Config.Endpoint field.
+type ConfigNoResolveEndpointProvider interface {
+	ClientConfigNoResolveEndpoint(cfgs ...*aws.Config) Config
+}
+
+// A Client implements the base client request and response handling
+// used by all service clients.
+type Client struct {
+	request.Retryer
+	metadata.ClientInfo
+
+	Config   aws.Config
+	Handlers request.Handlers
+}
+
+// New will return a pointer to a new initialized service client.
+func New(cfg aws.Config, info metadata.ClientInfo, handlers request.Handlers, options ...func(*Client)) *Client {
+	svc := &Client{
+		Config:     cfg,
+		ClientInfo: info,
+		Handlers:   handlers.Copy(),
+	}
+
+	switch retryer, ok := cfg.Retryer.(request.Retryer); {
+	case ok:
+		svc.Retryer = retryer
+	case cfg.Retryer != nil && cfg.Logger != nil:
+		s := fmt.Sprintf("WARNING: %T does not implement request.Retryer; using DefaultRetryer instead", cfg.Retryer)
+		cfg.Logger.Log(s)
+		fallthrough
+	default:
+		maxRetries := aws.IntValue(cfg.MaxRetries)
+		if cfg.MaxRetries == nil || maxRetries == aws.UseServiceDefaultRetries {
+			maxRetries = 3
+		}
+		svc.Retryer = DefaultRetryer{NumMaxRetries: maxRetries}
+	}
+
+	svc.AddDebugHandlers()
+
+	for _, option := range options {
+		option(svc)
+	}
+
+	return svc
+}
+
+// NewRequest returns a new Request pointer for the service API
+// operation and parameters.
+func (c *Client) NewRequest(operation *request.Operation, params interface{}, data interface{}) *request.Request {
+	return request.New(c.Config, c.ClientInfo, c.Handlers, c.Retryer, operation, params, data)
+}
+
+// AddDebugHandlers injects debug logging handlers into the service to log request
+// debug information.
+func (c *Client) AddDebugHandlers() {
+	if !c.Config.LogLevel.AtLeast(aws.LogDebug) {
+		return
+	}
+
+	c.Handlers.Send.PushFrontNamed(LogHTTPRequestHandler)
+	c.Handlers.Send.PushBackNamed(LogHTTPResponseHandler)
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/client/default_retryer.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/client/default_retryer.go
new file mode 100644
index 00000000..a397b0d0
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/client/default_retryer.go
@@ -0,0 +1,116 @@
+package client
+
+import (
+	"strconv"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws/request"
+	"github.com/aws/aws-sdk-go/internal/sdkrand"
+)
+
+// DefaultRetryer implements basic retry logic using exponential backoff for
+// most services. If you want to implement custom retry logic, implement the
+// request.Retryer interface or create a structure type that composes this
+// struct and override the specific methods. For example, to override only
+// the MaxRetries method:
+//
+//		type retryer struct {
+//      client.DefaultRetryer
+//    }
+//
+//    // This implementation always has 100 max retries
+//    func (d retryer) MaxRetries() int { return 100 }
+type DefaultRetryer struct {
+	NumMaxRetries int
+}
+
+// MaxRetries returns the number of maximum returns the service will use to make
+// an individual API request.
+func (d DefaultRetryer) MaxRetries() int {
+	return d.NumMaxRetries
+}
+
+// RetryRules returns the delay duration before retrying this request again
+func (d DefaultRetryer) RetryRules(r *request.Request) time.Duration {
+	// Set the upper limit of delay in retrying at ~five minutes
+	minTime := 30
+	throttle := d.shouldThrottle(r)
+	if throttle {
+		if delay, ok := getRetryDelay(r); ok {
+			return delay
+		}
+
+		minTime = 500
+	}
+
+	retryCount := r.RetryCount
+	if throttle && retryCount > 8 {
+		retryCount = 8
+	} else if retryCount > 13 {
+		retryCount = 13
+	}
+
+	delay := (1 << uint(retryCount)) * (sdkrand.SeededRand.Intn(minTime) + minTime)
+	return time.Duration(delay) * time.Millisecond
+}
+
+// ShouldRetry returns true if the request should be retried.
+func (d DefaultRetryer) ShouldRetry(r *request.Request) bool {
+	// If one of the other handlers already set the retry state
+	// we don't want to override it based on the service's state
+	if r.Retryable != nil {
+		return *r.Retryable
+	}
+
+	if r.HTTPResponse.StatusCode >= 500 && r.HTTPResponse.StatusCode != 501 {
+		return true
+	}
+	return r.IsErrorRetryable() || d.shouldThrottle(r)
+}
+
+// ShouldThrottle returns true if the request should be throttled.
+func (d DefaultRetryer) shouldThrottle(r *request.Request) bool {
+	switch r.HTTPResponse.StatusCode {
+	case 429:
+	case 502:
+	case 503:
+	case 504:
+	default:
+		return r.IsErrorThrottle()
+	}
+
+	return true
+}
+
+// This will look in the Retry-After header, RFC 7231, for how long
+// it will wait before attempting another request
+func getRetryDelay(r *request.Request) (time.Duration, bool) {
+	if !canUseRetryAfterHeader(r) {
+		return 0, false
+	}
+
+	delayStr := r.HTTPResponse.Header.Get("Retry-After")
+	if len(delayStr) == 0 {
+		return 0, false
+	}
+
+	delay, err := strconv.Atoi(delayStr)
+	if err != nil {
+		return 0, false
+	}
+
+	return time.Duration(delay) * time.Second, true
+}
+
+// Will look at the status code to see if the retry header pertains to
+// the status code.
+func canUseRetryAfterHeader(r *request.Request) bool {
+	switch r.HTTPResponse.StatusCode {
+	case 429:
+	case 503:
+	default:
+		return false
+	}
+
+	return true
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/client/logger.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/client/logger.go
new file mode 100644
index 00000000..7b5e1276
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/client/logger.go
@@ -0,0 +1,190 @@
+package client
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"net/http/httputil"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/request"
+)
+
+const logReqMsg = `DEBUG: Request %s/%s Details:
+---[ REQUEST POST-SIGN ]-----------------------------
+%s
+-----------------------------------------------------`
+
+const logReqErrMsg = `DEBUG ERROR: Request %s/%s:
+---[ REQUEST DUMP ERROR ]-----------------------------
+%s
+------------------------------------------------------`
+
+type logWriter struct {
+	// Logger is what we will use to log the payload of a response.
+	Logger aws.Logger
+	// buf stores the contents of what has been read
+	buf *bytes.Buffer
+}
+
+func (logger *logWriter) Write(b []byte) (int, error) {
+	return logger.buf.Write(b)
+}
+
+type teeReaderCloser struct {
+	// io.Reader will be a tee reader that is used during logging.
+	// This structure will read from a body and write the contents to a logger.
+	io.Reader
+	// Source is used just to close when we are done reading.
+	Source io.ReadCloser
+}
+
+func (reader *teeReaderCloser) Close() error {
+	return reader.Source.Close()
+}
+
+// LogHTTPRequestHandler is a SDK request handler to log the HTTP request sent
+// to a service. Will include the HTTP request body if the LogLevel of the
+// request matches LogDebugWithHTTPBody.
+var LogHTTPRequestHandler = request.NamedHandler{
+	Name: "awssdk.client.LogRequest",
+	Fn:   logRequest,
+}
+
+func logRequest(r *request.Request) {
+	logBody := r.Config.LogLevel.Matches(aws.LogDebugWithHTTPBody)
+	bodySeekable := aws.IsReaderSeekable(r.Body)
+
+	b, err := httputil.DumpRequestOut(r.HTTPRequest, logBody)
+	if err != nil {
+		r.Config.Logger.Log(fmt.Sprintf(logReqErrMsg,
+			r.ClientInfo.ServiceName, r.Operation.Name, err))
+		return
+	}
+
+	if logBody {
+		if !bodySeekable {
+			r.SetReaderBody(aws.ReadSeekCloser(r.HTTPRequest.Body))
+		}
+		// Reset the request body because dumpRequest will re-wrap the r.HTTPRequest's
+		// Body as a NoOpCloser and will not be reset after read by the HTTP
+		// client reader.
+		r.ResetBody()
+	}
+
+	r.Config.Logger.Log(fmt.Sprintf(logReqMsg,
+		r.ClientInfo.ServiceName, r.Operation.Name, string(b)))
+}
+
+// LogHTTPRequestHeaderHandler is a SDK request handler to log the HTTP request sent
+// to a service. Will only log the HTTP request's headers. The request payload
+// will not be read.
+var LogHTTPRequestHeaderHandler = request.NamedHandler{
+	Name: "awssdk.client.LogRequestHeader",
+	Fn:   logRequestHeader,
+}
+
+func logRequestHeader(r *request.Request) {
+	b, err := httputil.DumpRequestOut(r.HTTPRequest, false)
+	if err != nil {
+		r.Config.Logger.Log(fmt.Sprintf(logReqErrMsg,
+			r.ClientInfo.ServiceName, r.Operation.Name, err))
+		return
+	}
+
+	r.Config.Logger.Log(fmt.Sprintf(logReqMsg,
+		r.ClientInfo.ServiceName, r.Operation.Name, string(b)))
+}
+
+const logRespMsg = `DEBUG: Response %s/%s Details:
+---[ RESPONSE ]--------------------------------------
+%s
+-----------------------------------------------------`
+
+const logRespErrMsg = `DEBUG ERROR: Response %s/%s:
+---[ RESPONSE DUMP ERROR ]-----------------------------
+%s
+-----------------------------------------------------`
+
+// LogHTTPResponseHandler is a SDK request handler to log the HTTP response
+// received from a service. Will include the HTTP response body if the LogLevel
+// of the request matches LogDebugWithHTTPBody.
+var LogHTTPResponseHandler = request.NamedHandler{
+	Name: "awssdk.client.LogResponse",
+	Fn:   logResponse,
+}
+
+func logResponse(r *request.Request) {
+	lw := &logWriter{r.Config.Logger, bytes.NewBuffer(nil)}
+
+	if r.HTTPResponse == nil {
+		lw.Logger.Log(fmt.Sprintf(logRespErrMsg,
+			r.ClientInfo.ServiceName, r.Operation.Name, "request's HTTPResponse is nil"))
+		return
+	}
+
+	logBody := r.Config.LogLevel.Matches(aws.LogDebugWithHTTPBody)
+	if logBody {
+		r.HTTPResponse.Body = &teeReaderCloser{
+			Reader: io.TeeReader(r.HTTPResponse.Body, lw),
+			Source: r.HTTPResponse.Body,
+		}
+	}
+
+	handlerFn := func(req *request.Request) {
+		b, err := httputil.DumpResponse(req.HTTPResponse, false)
+		if err != nil {
+			lw.Logger.Log(fmt.Sprintf(logRespErrMsg,
+				req.ClientInfo.ServiceName, req.Operation.Name, err))
+			return
+		}
+
+		lw.Logger.Log(fmt.Sprintf(logRespMsg,
+			req.ClientInfo.ServiceName, req.Operation.Name, string(b)))
+
+		if logBody {
+			b, err := ioutil.ReadAll(lw.buf)
+			if err != nil {
+				lw.Logger.Log(fmt.Sprintf(logRespErrMsg,
+					req.ClientInfo.ServiceName, req.Operation.Name, err))
+				return
+			}
+
+			lw.Logger.Log(string(b))
+		}
+	}
+
+	const handlerName = "awsdk.client.LogResponse.ResponseBody"
+
+	r.Handlers.Unmarshal.SetBackNamed(request.NamedHandler{
+		Name: handlerName, Fn: handlerFn,
+	})
+	r.Handlers.UnmarshalError.SetBackNamed(request.NamedHandler{
+		Name: handlerName, Fn: handlerFn,
+	})
+}
+
+// LogHTTPResponseHeaderHandler is a SDK request handler to log the HTTP
+// response received from a service. Will only log the HTTP response's headers.
+// The response payload will not be read.
+var LogHTTPResponseHeaderHandler = request.NamedHandler{
+	Name: "awssdk.client.LogResponseHeader",
+	Fn:   logResponseHeader,
+}
+
+func logResponseHeader(r *request.Request) {
+	if r.Config.Logger == nil {
+		return
+	}
+
+	b, err := httputil.DumpResponse(r.HTTPResponse, false)
+	if err != nil {
+		r.Config.Logger.Log(fmt.Sprintf(logRespErrMsg,
+			r.ClientInfo.ServiceName, r.Operation.Name, err))
+		return
+	}
+
+	r.Config.Logger.Log(fmt.Sprintf(logRespMsg,
+		r.ClientInfo.ServiceName, r.Operation.Name, string(b)))
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/client/metadata/client_info.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/client/metadata/client_info.go
new file mode 100644
index 00000000..920e9fdd
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/client/metadata/client_info.go
@@ -0,0 +1,13 @@
+package metadata
+
+// ClientInfo wraps immutable data from the client.Client structure.
+type ClientInfo struct {
+	ServiceName   string
+	ServiceID     string
+	APIVersion    string
+	Endpoint      string
+	SigningName   string
+	SigningRegion string
+	JSONVersion   string
+	TargetPrefix  string
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/config.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/config.go
new file mode 100644
index 00000000..10634d17
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/config.go
@@ -0,0 +1,536 @@
+package aws
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws/credentials"
+	"github.com/aws/aws-sdk-go/aws/endpoints"
+)
+
+// UseServiceDefaultRetries instructs the config to use the service's own
+// default number of retries. This will be the default action if
+// Config.MaxRetries is nil also.
+const UseServiceDefaultRetries = -1
+
+// RequestRetryer is an alias for a type that implements the request.Retryer
+// interface.
+type RequestRetryer interface{}
+
+// A Config provides service configuration for service clients. By default,
+// all clients will use the defaults.DefaultConfig structure.
+//
+//     // Create Session with MaxRetry configuration to be shared by multiple
+//     // service clients.
+//     sess := session.Must(session.NewSession(&aws.Config{
+//         MaxRetries: aws.Int(3),
+//     }))
+//
+//     // Create S3 service client with a specific Region.
+//     svc := s3.New(sess, &aws.Config{
+//         Region: aws.String("us-west-2"),
+//     })
+type Config struct {
+	// Enables verbose error printing of all credential chain errors.
+	// Should be used when wanting to see all errors while attempting to
+	// retrieve credentials.
+	CredentialsChainVerboseErrors *bool
+
+	// The credentials object to use when signing requests. Defaults to a
+	// chain of credential providers to search for credentials in environment
+	// variables, shared credential file, and EC2 Instance Roles.
+	Credentials *credentials.Credentials
+
+	// An optional endpoint URL (hostname only or fully qualified URI)
+	// that overrides the default generated endpoint for a client. Set this
+	// to `""` to use the default generated endpoint.
+	//
+	// Note: You must still provide a `Region` value when specifying an
+	// endpoint for a client.
+	Endpoint *string
+
+	// The resolver to use for looking up endpoints for AWS service clients
+	// to use based on region.
+	EndpointResolver endpoints.Resolver
+
+	// EnforceShouldRetryCheck is used in the AfterRetryHandler to always call
+	// ShouldRetry regardless of whether or not if request.Retryable is set.
+	// This will utilize ShouldRetry method of custom retryers. If EnforceShouldRetryCheck
+	// is not set, then ShouldRetry will only be called if request.Retryable is nil.
+	// Proper handling of the request.Retryable field is important when setting this field.
+	EnforceShouldRetryCheck *bool
+
+	// The region to send requests to. This parameter is required and must
+	// be configured globally or on a per-client basis unless otherwise
+	// noted. A full list of regions is found in the "Regions and Endpoints"
+	// document.
+	//
+	// See http://docs.aws.amazon.com/general/latest/gr/rande.html for AWS
+	// Regions and Endpoints.
+	Region *string
+
+	// Set this to `true` to disable SSL when sending requests. Defaults
+	// to `false`.
+	DisableSSL *bool
+
+	// The HTTP client to use when sending requests. Defaults to
+	// `http.DefaultClient`.
+	HTTPClient *http.Client
+
+	// An integer value representing the logging level. The default log level
+	// is zero (LogOff), which represents no logging. To enable logging set
+	// to a LogLevel Value.
+	LogLevel *LogLevelType
+
+	// The logger writer interface to write logging messages to. Defaults to
+	// standard out.
+	Logger Logger
+
+	// The maximum number of times that a request will be retried for failures.
+	// Defaults to -1, which defers the max retry setting to the service
+	// specific configuration.
+	MaxRetries *int
+
+	// Retryer guides how HTTP requests should be retried in case of
+	// recoverable failures.
+	//
+	// When nil or the value does not implement the request.Retryer interface,
+	// the client.DefaultRetryer will be used.
+	//
+	// When both Retryer and MaxRetries are non-nil, the former is used and
+	// the latter ignored.
+	//
+	// To set the Retryer field in a type-safe manner and with chaining, use
+	// the request.WithRetryer helper function:
+	//
+	//   cfg := request.WithRetryer(aws.NewConfig(), myRetryer)
+	//
+	Retryer RequestRetryer
+
+	// Disables semantic parameter validation, which validates input for
+	// missing required fields and/or other semantic request input errors.
+	DisableParamValidation *bool
+
+	// Disables the computation of request and response checksums, e.g.,
+	// CRC32 checksums in Amazon DynamoDB.
+	DisableComputeChecksums *bool
+
+	// Set this to `true` to force the request to use path-style addressing,
+	// i.e., `http://s3.amazonaws.com/BUCKET/KEY`. By default, the S3 client
+	// will use virtual hosted bucket addressing when possible
+	// (`http://BUCKET.s3.amazonaws.com/KEY`).
+	//
+	// Note: This configuration option is specific to the Amazon S3 service.
+	//
+	// See http://docs.aws.amazon.com/AmazonS3/latest/dev/VirtualHosting.html
+	// for Amazon S3: Virtual Hosting of Buckets
+	S3ForcePathStyle *bool
+
+	// Set this to `true` to disable the SDK adding the `Expect: 100-Continue`
+	// header to PUT requests over 2MB of content. 100-Continue instructs the
+	// HTTP client not to send the body until the service responds with a
+	// `continue` status. This is useful to prevent sending the request body
+	// until after the request is authenticated, and validated.
+	//
+	// http://docs.aws.amazon.com/AmazonS3/latest/API/RESTObjectPUT.html
+	//
+	// 100-Continue is only enabled for Go 1.6 and above. See `http.Transport`'s
+	// `ExpectContinueTimeout` for information on adjusting the continue wait
+	// timeout. https://golang.org/pkg/net/http/#Transport
+	//
+	// You should use this flag to disble 100-Continue if you experience issues
+	// with proxies or third party S3 compatible services.
+	S3Disable100Continue *bool
+
+	// Set this to `true` to enable S3 Accelerate feature. For all operations
+	// compatible with S3 Accelerate will use the accelerate endpoint for
+	// requests. Requests not compatible will fall back to normal S3 requests.
+	//
+	// The bucket must be enable for accelerate to be used with S3 client with
+	// accelerate enabled. If the bucket is not enabled for accelerate an error
+	// will be returned. The bucket name must be DNS compatible to also work
+	// with accelerate.
+	S3UseAccelerate *bool
+
+	// S3DisableContentMD5Validation config option is temporarily disabled,
+	// For S3 GetObject API calls, #1837.
+	//
+	// Set this to `true` to disable the S3 service client from automatically
+	// adding the ContentMD5 to S3 Object Put and Upload API calls. This option
+	// will also disable the SDK from performing object ContentMD5 validation
+	// on GetObject API calls.
+	S3DisableContentMD5Validation *bool
+
+	// Set this to `true` to disable the EC2Metadata client from overriding the
+	// default http.Client's Timeout. This is helpful if you do not want the
+	// EC2Metadata client to create a new http.Client. This options is only
+	// meaningful if you're not already using a custom HTTP client with the
+	// SDK. Enabled by default.
+	//
+	// Must be set and provided to the session.NewSession() in order to disable
+	// the EC2Metadata overriding the timeout for default credentials chain.
+	//
+	// Example:
+	//    sess := session.Must(session.NewSession(aws.NewConfig()
+	//       .WithEC2MetadataDiableTimeoutOverride(true)))
+	//
+	//    svc := s3.New(sess)
+	//
+	EC2MetadataDisableTimeoutOverride *bool
+
+	// Instructs the endpoint to be generated for a service client to
+	// be the dual stack endpoint. The dual stack endpoint will support
+	// both IPv4 and IPv6 addressing.
+	//
+	// Setting this for a service which does not support dual stack will fail
+	// to make requets. It is not recommended to set this value on the session
+	// as it will apply to all service clients created with the session. Even
+	// services which don't support dual stack endpoints.
+	//
+	// If the Endpoint config value is also provided the UseDualStack flag
+	// will be ignored.
+	//
+	// Only supported with.
+	//
+	//     sess := session.Must(session.NewSession())
+	//
+	//     svc := s3.New(sess, &aws.Config{
+	//         UseDualStack: aws.Bool(true),
+	//     })
+	UseDualStack *bool
+
+	// SleepDelay is an override for the func the SDK will call when sleeping
+	// during the lifecycle of a request. Specifically this will be used for
+	// request delays. This value should only be used for testing. To adjust
+	// the delay of a request see the aws/client.DefaultRetryer and
+	// aws/request.Retryer.
+	//
+	// SleepDelay will prevent any Context from being used for canceling retry
+	// delay of an API operation. It is recommended to not use SleepDelay at all
+	// and specify a Retryer instead.
+	SleepDelay func(time.Duration)
+
+	// DisableRestProtocolURICleaning will not clean the URL path when making rest protocol requests.
+	// Will default to false. This would only be used for empty directory names in s3 requests.
+	//
+	// Example:
+	//    sess := session.Must(session.NewSession(&aws.Config{
+	//         DisableRestProtocolURICleaning: aws.Bool(true),
+	//    }))
+	//
+	//    svc := s3.New(sess)
+	//    out, err := svc.GetObject(&s3.GetObjectInput {
+	//    	Bucket: aws.String("bucketname"),
+	//    	Key: aws.String("//foo//bar//moo"),
+	//    })
+	DisableRestProtocolURICleaning *bool
+
+	// EnableEndpointDiscovery will allow for endpoint discovery on operations that
+	// have the definition in its model. By default, endpoint discovery is off.
+	//
+	// Example:
+	//    sess := session.Must(session.NewSession(&aws.Config{
+	//         EnableEndpointDiscovery: aws.Bool(true),
+	//    }))
+	//
+	//    svc := s3.New(sess)
+	//    out, err := svc.GetObject(&s3.GetObjectInput {
+	//    	Bucket: aws.String("bucketname"),
+	//    	Key: aws.String("/foo/bar/moo"),
+	//    })
+	EnableEndpointDiscovery *bool
+
+	// DisableEndpointHostPrefix will disable the SDK's behavior of prefixing
+	// request endpoint hosts with modeled information.
+	//
+	// Disabling this feature is useful when you want to use local endpoints
+	// for testing that do not support the modeled host prefix pattern.
+	DisableEndpointHostPrefix *bool
+}
+
+// NewConfig returns a new Config pointer that can be chained with builder
+// methods to set multiple configuration values inline without using pointers.
+//
+//     // Create Session with MaxRetry configuration to be shared by multiple
+//     // service clients.
+//     sess := session.Must(session.NewSession(aws.NewConfig().
+//         WithMaxRetries(3),
+//     ))
+//
+//     // Create S3 service client with a specific Region.
+//     svc := s3.New(sess, aws.NewConfig().
+//         WithRegion("us-west-2"),
+//     )
+func NewConfig() *Config {
+	return &Config{}
+}
+
+// WithCredentialsChainVerboseErrors sets a config verbose errors boolean and returning
+// a Config pointer.
+func (c *Config) WithCredentialsChainVerboseErrors(verboseErrs bool) *Config {
+	c.CredentialsChainVerboseErrors = &verboseErrs
+	return c
+}
+
+// WithCredentials sets a config Credentials value returning a Config pointer
+// for chaining.
+func (c *Config) WithCredentials(creds *credentials.Credentials) *Config {
+	c.Credentials = creds
+	return c
+}
+
+// WithEndpoint sets a config Endpoint value returning a Config pointer for
+// chaining.
+func (c *Config) WithEndpoint(endpoint string) *Config {
+	c.Endpoint = &endpoint
+	return c
+}
+
+// WithEndpointResolver sets a config EndpointResolver value returning a
+// Config pointer for chaining.
+func (c *Config) WithEndpointResolver(resolver endpoints.Resolver) *Config {
+	c.EndpointResolver = resolver
+	return c
+}
+
+// WithRegion sets a config Region value returning a Config pointer for
+// chaining.
+func (c *Config) WithRegion(region string) *Config {
+	c.Region = &region
+	return c
+}
+
+// WithDisableSSL sets a config DisableSSL value returning a Config pointer
+// for chaining.
+func (c *Config) WithDisableSSL(disable bool) *Config {
+	c.DisableSSL = &disable
+	return c
+}
+
+// WithHTTPClient sets a config HTTPClient value returning a Config pointer
+// for chaining.
+func (c *Config) WithHTTPClient(client *http.Client) *Config {
+	c.HTTPClient = client
+	return c
+}
+
+// WithMaxRetries sets a config MaxRetries value returning a Config pointer
+// for chaining.
+func (c *Config) WithMaxRetries(max int) *Config {
+	c.MaxRetries = &max
+	return c
+}
+
+// WithDisableParamValidation sets a config DisableParamValidation value
+// returning a Config pointer for chaining.
+func (c *Config) WithDisableParamValidation(disable bool) *Config {
+	c.DisableParamValidation = &disable
+	return c
+}
+
+// WithDisableComputeChecksums sets a config DisableComputeChecksums value
+// returning a Config pointer for chaining.
+func (c *Config) WithDisableComputeChecksums(disable bool) *Config {
+	c.DisableComputeChecksums = &disable
+	return c
+}
+
+// WithLogLevel sets a config LogLevel value returning a Config pointer for
+// chaining.
+func (c *Config) WithLogLevel(level LogLevelType) *Config {
+	c.LogLevel = &level
+	return c
+}
+
+// WithLogger sets a config Logger value returning a Config pointer for
+// chaining.
+func (c *Config) WithLogger(logger Logger) *Config {
+	c.Logger = logger
+	return c
+}
+
+// WithS3ForcePathStyle sets a config S3ForcePathStyle value returning a Config
+// pointer for chaining.
+func (c *Config) WithS3ForcePathStyle(force bool) *Config {
+	c.S3ForcePathStyle = &force
+	return c
+}
+
+// WithS3Disable100Continue sets a config S3Disable100Continue value returning
+// a Config pointer for chaining.
+func (c *Config) WithS3Disable100Continue(disable bool) *Config {
+	c.S3Disable100Continue = &disable
+	return c
+}
+
+// WithS3UseAccelerate sets a config S3UseAccelerate value returning a Config
+// pointer for chaining.
+func (c *Config) WithS3UseAccelerate(enable bool) *Config {
+	c.S3UseAccelerate = &enable
+	return c
+
+}
+
+// WithS3DisableContentMD5Validation sets a config
+// S3DisableContentMD5Validation value returning a Config pointer for chaining.
+func (c *Config) WithS3DisableContentMD5Validation(enable bool) *Config {
+	c.S3DisableContentMD5Validation = &enable
+	return c
+
+}
+
+// WithUseDualStack sets a config UseDualStack value returning a Config
+// pointer for chaining.
+func (c *Config) WithUseDualStack(enable bool) *Config {
+	c.UseDualStack = &enable
+	return c
+}
+
+// WithEC2MetadataDisableTimeoutOverride sets a config EC2MetadataDisableTimeoutOverride value
+// returning a Config pointer for chaining.
+func (c *Config) WithEC2MetadataDisableTimeoutOverride(enable bool) *Config {
+	c.EC2MetadataDisableTimeoutOverride = &enable
+	return c
+}
+
+// WithSleepDelay overrides the function used to sleep while waiting for the
+// next retry. Defaults to time.Sleep.
+func (c *Config) WithSleepDelay(fn func(time.Duration)) *Config {
+	c.SleepDelay = fn
+	return c
+}
+
+// WithEndpointDiscovery will set whether or not to use endpoint discovery.
+func (c *Config) WithEndpointDiscovery(t bool) *Config {
+	c.EnableEndpointDiscovery = &t
+	return c
+}
+
+// WithDisableEndpointHostPrefix will set whether or not to use modeled host prefix
+// when making requests.
+func (c *Config) WithDisableEndpointHostPrefix(t bool) *Config {
+	c.DisableEndpointHostPrefix = &t
+	return c
+}
+
+// MergeIn merges the passed in configs into the existing config object.
+func (c *Config) MergeIn(cfgs ...*Config) {
+	for _, other := range cfgs {
+		mergeInConfig(c, other)
+	}
+}
+
+func mergeInConfig(dst *Config, other *Config) {
+	if other == nil {
+		return
+	}
+
+	if other.CredentialsChainVerboseErrors != nil {
+		dst.CredentialsChainVerboseErrors = other.CredentialsChainVerboseErrors
+	}
+
+	if other.Credentials != nil {
+		dst.Credentials = other.Credentials
+	}
+
+	if other.Endpoint != nil {
+		dst.Endpoint = other.Endpoint
+	}
+
+	if other.EndpointResolver != nil {
+		dst.EndpointResolver = other.EndpointResolver
+	}
+
+	if other.Region != nil {
+		dst.Region = other.Region
+	}
+
+	if other.DisableSSL != nil {
+		dst.DisableSSL = other.DisableSSL
+	}
+
+	if other.HTTPClient != nil {
+		dst.HTTPClient = other.HTTPClient
+	}
+
+	if other.LogLevel != nil {
+		dst.LogLevel = other.LogLevel
+	}
+
+	if other.Logger != nil {
+		dst.Logger = other.Logger
+	}
+
+	if other.MaxRetries != nil {
+		dst.MaxRetries = other.MaxRetries
+	}
+
+	if other.Retryer != nil {
+		dst.Retryer = other.Retryer
+	}
+
+	if other.DisableParamValidation != nil {
+		dst.DisableParamValidation = other.DisableParamValidation
+	}
+
+	if other.DisableComputeChecksums != nil {
+		dst.DisableComputeChecksums = other.DisableComputeChecksums
+	}
+
+	if other.S3ForcePathStyle != nil {
+		dst.S3ForcePathStyle = other.S3ForcePathStyle
+	}
+
+	if other.S3Disable100Continue != nil {
+		dst.S3Disable100Continue = other.S3Disable100Continue
+	}
+
+	if other.S3UseAccelerate != nil {
+		dst.S3UseAccelerate = other.S3UseAccelerate
+	}
+
+	if other.S3DisableContentMD5Validation != nil {
+		dst.S3DisableContentMD5Validation = other.S3DisableContentMD5Validation
+	}
+
+	if other.UseDualStack != nil {
+		dst.UseDualStack = other.UseDualStack
+	}
+
+	if other.EC2MetadataDisableTimeoutOverride != nil {
+		dst.EC2MetadataDisableTimeoutOverride = other.EC2MetadataDisableTimeoutOverride
+	}
+
+	if other.SleepDelay != nil {
+		dst.SleepDelay = other.SleepDelay
+	}
+
+	if other.DisableRestProtocolURICleaning != nil {
+		dst.DisableRestProtocolURICleaning = other.DisableRestProtocolURICleaning
+	}
+
+	if other.EnforceShouldRetryCheck != nil {
+		dst.EnforceShouldRetryCheck = other.EnforceShouldRetryCheck
+	}
+
+	if other.EnableEndpointDiscovery != nil {
+		dst.EnableEndpointDiscovery = other.EnableEndpointDiscovery
+	}
+
+	if other.DisableEndpointHostPrefix != nil {
+		dst.DisableEndpointHostPrefix = other.DisableEndpointHostPrefix
+	}
+}
+
+// Copy will return a shallow copy of the Config object. If any additional
+// configurations are provided they will be merged into the new config returned.
+func (c *Config) Copy(cfgs ...*Config) *Config {
+	dst := &Config{}
+	dst.MergeIn(c)
+
+	for _, cfg := range cfgs {
+		dst.MergeIn(cfg)
+	}
+
+	return dst
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/context_1_5.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/context_1_5.go
new file mode 100644
index 00000000..2866f9a7
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/context_1_5.go
@@ -0,0 +1,37 @@
+// +build !go1.9
+
+package aws
+
+import "time"
+
+// Context is an copy of the Go v1.7 stdlib's context.Context interface.
+// It is represented as a SDK interface to enable you to use the "WithContext"
+// API methods with Go v1.6 and a Context type such as golang.org/x/net/context.
+//
+// See https://golang.org/pkg/context on how to use contexts.
+type Context interface {
+	// Deadline returns the time when work done on behalf of this context
+	// should be canceled. Deadline returns ok==false when no deadline is
+	// set. Successive calls to Deadline return the same results.
+	Deadline() (deadline time.Time, ok bool)
+
+	// Done returns a channel that's closed when work done on behalf of this
+	// context should be canceled. Done may return nil if this context can
+	// never be canceled. Successive calls to Done return the same value.
+	Done() <-chan struct{}
+
+	// Err returns a non-nil error value after Done is closed. Err returns
+	// Canceled if the context was canceled or DeadlineExceeded if the
+	// context's deadline passed. No other values for Err are defined.
+	// After Done is closed, successive calls to Err return the same value.
+	Err() error
+
+	// Value returns the value associated with this context for key, or nil
+	// if no value is associated with key. Successive calls to Value with
+	// the same key returns the same result.
+	//
+	// Use context values only for request-scoped data that transits
+	// processes and API boundaries, not for passing optional parameters to
+	// functions.
+	Value(key interface{}) interface{}
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/context_1_9.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/context_1_9.go
new file mode 100644
index 00000000..3718b26e
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/context_1_9.go
@@ -0,0 +1,11 @@
+// +build go1.9
+
+package aws
+
+import "context"
+
+// Context is an alias of the Go stdlib's context.Context interface.
+// It can be used within the SDK's API operation "WithContext" methods.
+//
+// See https://golang.org/pkg/context on how to use contexts.
+type Context = context.Context
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/context_background_1_5.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/context_background_1_5.go
new file mode 100644
index 00000000..66c5945d
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/context_background_1_5.go
@@ -0,0 +1,56 @@
+// +build !go1.7
+
+package aws
+
+import "time"
+
+// An emptyCtx is a copy of the Go 1.7 context.emptyCtx type. This is copied to
+// provide a 1.6 and 1.5 safe version of context that is compatible with Go
+// 1.7's Context.
+//
+// An emptyCtx is never canceled, has no values, and has no deadline. It is not
+// struct{}, since vars of this type must have distinct addresses.
+type emptyCtx int
+
+func (*emptyCtx) Deadline() (deadline time.Time, ok bool) {
+	return
+}
+
+func (*emptyCtx) Done() <-chan struct{} {
+	return nil
+}
+
+func (*emptyCtx) Err() error {
+	return nil
+}
+
+func (*emptyCtx) Value(key interface{}) interface{} {
+	return nil
+}
+
+func (e *emptyCtx) String() string {
+	switch e {
+	case backgroundCtx:
+		return "aws.BackgroundContext"
+	}
+	return "unknown empty Context"
+}
+
+var (
+	backgroundCtx = new(emptyCtx)
+)
+
+// BackgroundContext returns a context that will never be canceled, has no
+// values, and no deadline. This context is used by the SDK to provide
+// backwards compatibility with non-context API operations and functionality.
+//
+// Go 1.6 and before:
+// This context function is equivalent to context.Background in the Go stdlib.
+//
+// Go 1.7 and later:
+// The context returned will be the value returned by context.Background()
+//
+// See https://golang.org/pkg/context for more information on Contexts.
+func BackgroundContext() Context {
+	return backgroundCtx
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/context_background_1_7.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/context_background_1_7.go
new file mode 100644
index 00000000..9c29f29a
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/context_background_1_7.go
@@ -0,0 +1,20 @@
+// +build go1.7
+
+package aws
+
+import "context"
+
+// BackgroundContext returns a context that will never be canceled, has no
+// values, and no deadline. This context is used by the SDK to provide
+// backwards compatibility with non-context API operations and functionality.
+//
+// Go 1.6 and before:
+// This context function is equivalent to context.Background in the Go stdlib.
+//
+// Go 1.7 and later:
+// The context returned will be the value returned by context.Background()
+//
+// See https://golang.org/pkg/context for more information on Contexts.
+func BackgroundContext() Context {
+	return context.Background()
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/context_sleep.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/context_sleep.go
new file mode 100644
index 00000000..304fd156
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/context_sleep.go
@@ -0,0 +1,24 @@
+package aws
+
+import (
+	"time"
+)
+
+// SleepWithContext will wait for the timer duration to expire, or the context
+// is canceled. Which ever happens first. If the context is canceled the Context's
+// error will be returned.
+//
+// Expects Context to always return a non-nil error if the Done channel is closed.
+func SleepWithContext(ctx Context, dur time.Duration) error {
+	t := time.NewTimer(dur)
+	defer t.Stop()
+
+	select {
+	case <-t.C:
+		break
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+
+	return nil
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/convert_types.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/convert_types.go
new file mode 100644
index 00000000..ff5d58e0
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/convert_types.go
@@ -0,0 +1,387 @@
+package aws
+
+import "time"
+
+// String returns a pointer to the string value passed in.
+func String(v string) *string {
+	return &v
+}
+
+// StringValue returns the value of the string pointer passed in or
+// "" if the pointer is nil.
+func StringValue(v *string) string {
+	if v != nil {
+		return *v
+	}
+	return ""
+}
+
+// StringSlice converts a slice of string values into a slice of
+// string pointers
+func StringSlice(src []string) []*string {
+	dst := make([]*string, len(src))
+	for i := 0; i < len(src); i++ {
+		dst[i] = &(src[i])
+	}
+	return dst
+}
+
+// StringValueSlice converts a slice of string pointers into a slice of
+// string values
+func StringValueSlice(src []*string) []string {
+	dst := make([]string, len(src))
+	for i := 0; i < len(src); i++ {
+		if src[i] != nil {
+			dst[i] = *(src[i])
+		}
+	}
+	return dst
+}
+
+// StringMap converts a string map of string values into a string
+// map of string pointers
+func StringMap(src map[string]string) map[string]*string {
+	dst := make(map[string]*string)
+	for k, val := range src {
+		v := val
+		dst[k] = &v
+	}
+	return dst
+}
+
+// StringValueMap converts a string map of string pointers into a string
+// map of string values
+func StringValueMap(src map[string]*string) map[string]string {
+	dst := make(map[string]string)
+	for k, val := range src {
+		if val != nil {
+			dst[k] = *val
+		}
+	}
+	return dst
+}
+
+// Bool returns a pointer to the bool value passed in.
+func Bool(v bool) *bool {
+	return &v
+}
+
+// BoolValue returns the value of the bool pointer passed in or
+// false if the pointer is nil.
+func BoolValue(v *bool) bool {
+	if v != nil {
+		return *v
+	}
+	return false
+}
+
+// BoolSlice converts a slice of bool values into a slice of
+// bool pointers
+func BoolSlice(src []bool) []*bool {
+	dst := make([]*bool, len(src))
+	for i := 0; i < len(src); i++ {
+		dst[i] = &(src[i])
+	}
+	return dst
+}
+
+// BoolValueSlice converts a slice of bool pointers into a slice of
+// bool values
+func BoolValueSlice(src []*bool) []bool {
+	dst := make([]bool, len(src))
+	for i := 0; i < len(src); i++ {
+		if src[i] != nil {
+			dst[i] = *(src[i])
+		}
+	}
+	return dst
+}
+
+// BoolMap converts a string map of bool values into a string
+// map of bool pointers
+func BoolMap(src map[string]bool) map[string]*bool {
+	dst := make(map[string]*bool)
+	for k, val := range src {
+		v := val
+		dst[k] = &v
+	}
+	return dst
+}
+
+// BoolValueMap converts a string map of bool pointers into a string
+// map of bool values
+func BoolValueMap(src map[string]*bool) map[string]bool {
+	dst := make(map[string]bool)
+	for k, val := range src {
+		if val != nil {
+			dst[k] = *val
+		}
+	}
+	return dst
+}
+
+// Int returns a pointer to the int value passed in.
+func Int(v int) *int {
+	return &v
+}
+
+// IntValue returns the value of the int pointer passed in or
+// 0 if the pointer is nil.
+func IntValue(v *int) int {
+	if v != nil {
+		return *v
+	}
+	return 0
+}
+
+// IntSlice converts a slice of int values into a slice of
+// int pointers
+func IntSlice(src []int) []*int {
+	dst := make([]*int, len(src))
+	for i := 0; i < len(src); i++ {
+		dst[i] = &(src[i])
+	}
+	return dst
+}
+
+// IntValueSlice converts a slice of int pointers into a slice of
+// int values
+func IntValueSlice(src []*int) []int {
+	dst := make([]int, len(src))
+	for i := 0; i < len(src); i++ {
+		if src[i] != nil {
+			dst[i] = *(src[i])
+		}
+	}
+	return dst
+}
+
+// IntMap converts a string map of int values into a string
+// map of int pointers
+func IntMap(src map[string]int) map[string]*int {
+	dst := make(map[string]*int)
+	for k, val := range src {
+		v := val
+		dst[k] = &v
+	}
+	return dst
+}
+
+// IntValueMap converts a string map of int pointers into a string
+// map of int values
+func IntValueMap(src map[string]*int) map[string]int {
+	dst := make(map[string]int)
+	for k, val := range src {
+		if val != nil {
+			dst[k] = *val
+		}
+	}
+	return dst
+}
+
+// Int64 returns a pointer to the int64 value passed in.
+func Int64(v int64) *int64 {
+	return &v
+}
+
+// Int64Value returns the value of the int64 pointer passed in or
+// 0 if the pointer is nil.
+func Int64Value(v *int64) int64 {
+	if v != nil {
+		return *v
+	}
+	return 0
+}
+
+// Int64Slice converts a slice of int64 values into a slice of
+// int64 pointers
+func Int64Slice(src []int64) []*int64 {
+	dst := make([]*int64, len(src))
+	for i := 0; i < len(src); i++ {
+		dst[i] = &(src[i])
+	}
+	return dst
+}
+
+// Int64ValueSlice converts a slice of int64 pointers into a slice of
+// int64 values
+func Int64ValueSlice(src []*int64) []int64 {
+	dst := make([]int64, len(src))
+	for i := 0; i < len(src); i++ {
+		if src[i] != nil {
+			dst[i] = *(src[i])
+		}
+	}
+	return dst
+}
+
+// Int64Map converts a string map of int64 values into a string
+// map of int64 pointers
+func Int64Map(src map[string]int64) map[string]*int64 {
+	dst := make(map[string]*int64)
+	for k, val := range src {
+		v := val
+		dst[k] = &v
+	}
+	return dst
+}
+
+// Int64ValueMap converts a string map of int64 pointers into a string
+// map of int64 values
+func Int64ValueMap(src map[string]*int64) map[string]int64 {
+	dst := make(map[string]int64)
+	for k, val := range src {
+		if val != nil {
+			dst[k] = *val
+		}
+	}
+	return dst
+}
+
+// Float64 returns a pointer to the float64 value passed in.
+func Float64(v float64) *float64 {
+	return &v
+}
+
+// Float64Value returns the value of the float64 pointer passed in or
+// 0 if the pointer is nil.
+func Float64Value(v *float64) float64 {
+	if v != nil {
+		return *v
+	}
+	return 0
+}
+
+// Float64Slice converts a slice of float64 values into a slice of
+// float64 pointers
+func Float64Slice(src []float64) []*float64 {
+	dst := make([]*float64, len(src))
+	for i := 0; i < len(src); i++ {
+		dst[i] = &(src[i])
+	}
+	return dst
+}
+
+// Float64ValueSlice converts a slice of float64 pointers into a slice of
+// float64 values
+func Float64ValueSlice(src []*float64) []float64 {
+	dst := make([]float64, len(src))
+	for i := 0; i < len(src); i++ {
+		if src[i] != nil {
+			dst[i] = *(src[i])
+		}
+	}
+	return dst
+}
+
+// Float64Map converts a string map of float64 values into a string
+// map of float64 pointers
+func Float64Map(src map[string]float64) map[string]*float64 {
+	dst := make(map[string]*float64)
+	for k, val := range src {
+		v := val
+		dst[k] = &v
+	}
+	return dst
+}
+
+// Float64ValueMap converts a string map of float64 pointers into a string
+// map of float64 values
+func Float64ValueMap(src map[string]*float64) map[string]float64 {
+	dst := make(map[string]float64)
+	for k, val := range src {
+		if val != nil {
+			dst[k] = *val
+		}
+	}
+	return dst
+}
+
+// Time returns a pointer to the time.Time value passed in.
+func Time(v time.Time) *time.Time {
+	return &v
+}
+
+// TimeValue returns the value of the time.Time pointer passed in or
+// time.Time{} if the pointer is nil.
+func TimeValue(v *time.Time) time.Time {
+	if v != nil {
+		return *v
+	}
+	return time.Time{}
+}
+
+// SecondsTimeValue converts an int64 pointer to a time.Time value
+// representing seconds since Epoch or time.Time{} if the pointer is nil.
+func SecondsTimeValue(v *int64) time.Time {
+	if v != nil {
+		return time.Unix((*v / 1000), 0)
+	}
+	return time.Time{}
+}
+
+// MillisecondsTimeValue converts an int64 pointer to a time.Time value
+// representing milliseconds sinch Epoch or time.Time{} if the pointer is nil.
+func MillisecondsTimeValue(v *int64) time.Time {
+	if v != nil {
+		return time.Unix(0, (*v * 1000000))
+	}
+	return time.Time{}
+}
+
+// TimeUnixMilli returns a Unix timestamp in milliseconds from "January 1, 1970 UTC".
+// The result is undefined if the Unix time cannot be represented by an int64.
+// Which includes calling TimeUnixMilli on a zero Time is undefined.
+//
+// This utility is useful for service API's such as CloudWatch Logs which require
+// their unix time values to be in milliseconds.
+//
+// See Go stdlib https://golang.org/pkg/time/#Time.UnixNano for more information.
+func TimeUnixMilli(t time.Time) int64 {
+	return t.UnixNano() / int64(time.Millisecond/time.Nanosecond)
+}
+
+// TimeSlice converts a slice of time.Time values into a slice of
+// time.Time pointers
+func TimeSlice(src []time.Time) []*time.Time {
+	dst := make([]*time.Time, len(src))
+	for i := 0; i < len(src); i++ {
+		dst[i] = &(src[i])
+	}
+	return dst
+}
+
+// TimeValueSlice converts a slice of time.Time pointers into a slice of
+// time.Time values
+func TimeValueSlice(src []*time.Time) []time.Time {
+	dst := make([]time.Time, len(src))
+	for i := 0; i < len(src); i++ {
+		if src[i] != nil {
+			dst[i] = *(src[i])
+		}
+	}
+	return dst
+}
+
+// TimeMap converts a string map of time.Time values into a string
+// map of time.Time pointers
+func TimeMap(src map[string]time.Time) map[string]*time.Time {
+	dst := make(map[string]*time.Time)
+	for k, val := range src {
+		v := val
+		dst[k] = &v
+	}
+	return dst
+}
+
+// TimeValueMap converts a string map of time.Time pointers into a string
+// map of time.Time values
+func TimeValueMap(src map[string]*time.Time) map[string]time.Time {
+	dst := make(map[string]time.Time)
+	for k, val := range src {
+		if val != nil {
+			dst[k] = *val
+		}
+	}
+	return dst
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/handlers.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/handlers.go
new file mode 100644
index 00000000..f8853d78
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/handlers.go
@@ -0,0 +1,228 @@
+package corehandlers
+
+import (
+	"bytes"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"net/url"
+	"regexp"
+	"strconv"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/credentials"
+	"github.com/aws/aws-sdk-go/aws/request"
+)
+
+// Interface for matching types which also have a Len method.
+type lener interface {
+	Len() int
+}
+
+// BuildContentLengthHandler builds the content length of a request based on the body,
+// or will use the HTTPRequest.Header's "Content-Length" if defined. If unable
+// to determine request body length and no "Content-Length" was specified it will panic.
+//
+// The Content-Length will only be added to the request if the length of the body
+// is greater than 0. If the body is empty or the current `Content-Length`
+// header is <= 0, the header will also be stripped.
+var BuildContentLengthHandler = request.NamedHandler{Name: "core.BuildContentLengthHandler", Fn: func(r *request.Request) {
+	var length int64
+
+	if slength := r.HTTPRequest.Header.Get("Content-Length"); slength != "" {
+		length, _ = strconv.ParseInt(slength, 10, 64)
+	} else {
+		if r.Body != nil {
+			var err error
+			length, err = aws.SeekerLen(r.Body)
+			if err != nil {
+				r.Error = awserr.New(request.ErrCodeSerialization, "failed to get request body's length", err)
+				return
+			}
+		}
+	}
+
+	if length > 0 {
+		r.HTTPRequest.ContentLength = length
+		r.HTTPRequest.Header.Set("Content-Length", fmt.Sprintf("%d", length))
+	} else {
+		r.HTTPRequest.ContentLength = 0
+		r.HTTPRequest.Header.Del("Content-Length")
+	}
+}}
+
+var reStatusCode = regexp.MustCompile(`^(\d{3})`)
+
+// ValidateReqSigHandler is a request handler to ensure that the request's
+// signature doesn't expire before it is sent. This can happen when a request
+// is built and signed significantly before it is sent. Or significant delays
+// occur when retrying requests that would cause the signature to expire.
+var ValidateReqSigHandler = request.NamedHandler{
+	Name: "core.ValidateReqSigHandler",
+	Fn: func(r *request.Request) {
+		// Unsigned requests are not signed
+		if r.Config.Credentials == credentials.AnonymousCredentials {
+			return
+		}
+
+		signedTime := r.Time
+		if !r.LastSignedAt.IsZero() {
+			signedTime = r.LastSignedAt
+		}
+
+		// 5 minutes to allow for some clock skew/delays in transmission.
+		// Would be improved with aws/aws-sdk-go#423
+		if signedTime.Add(5 * time.Minute).After(time.Now()) {
+			return
+		}
+
+		fmt.Println("request expired, resigning")
+		r.Sign()
+	},
+}
+
+// SendHandler is a request handler to send service request using HTTP client.
+var SendHandler = request.NamedHandler{
+	Name: "core.SendHandler",
+	Fn: func(r *request.Request) {
+		sender := sendFollowRedirects
+		if r.DisableFollowRedirects {
+			sender = sendWithoutFollowRedirects
+		}
+
+		if request.NoBody == r.HTTPRequest.Body {
+			// Strip off the request body if the NoBody reader was used as a
+			// place holder for a request body. This prevents the SDK from
+			// making requests with a request body when it would be invalid
+			// to do so.
+			//
+			// Use a shallow copy of the http.Request to ensure the race condition
+			// of transport on Body will not trigger
+			reqOrig, reqCopy := r.HTTPRequest, *r.HTTPRequest
+			reqCopy.Body = nil
+			r.HTTPRequest = &reqCopy
+			defer func() {
+				r.HTTPRequest = reqOrig
+			}()
+		}
+
+		var err error
+		r.HTTPResponse, err = sender(r)
+		if err != nil {
+			handleSendError(r, err)
+		}
+	},
+}
+
+func sendFollowRedirects(r *request.Request) (*http.Response, error) {
+	return r.Config.HTTPClient.Do(r.HTTPRequest)
+}
+
+func sendWithoutFollowRedirects(r *request.Request) (*http.Response, error) {
+	transport := r.Config.HTTPClient.Transport
+	if transport == nil {
+		transport = http.DefaultTransport
+	}
+
+	return transport.RoundTrip(r.HTTPRequest)
+}
+
+func handleSendError(r *request.Request, err error) {
+	// Prevent leaking if an HTTPResponse was returned. Clean up
+	// the body.
+	if r.HTTPResponse != nil {
+		r.HTTPResponse.Body.Close()
+	}
+	// Capture the case where url.Error is returned for error processing
+	// response. e.g. 301 without location header comes back as string
+	// error and r.HTTPResponse is nil. Other URL redirect errors will
+	// comeback in a similar method.
+	if e, ok := err.(*url.Error); ok && e.Err != nil {
+		if s := reStatusCode.FindStringSubmatch(e.Err.Error()); s != nil {
+			code, _ := strconv.ParseInt(s[1], 10, 64)
+			r.HTTPResponse = &http.Response{
+				StatusCode: int(code),
+				Status:     http.StatusText(int(code)),
+				Body:       ioutil.NopCloser(bytes.NewReader([]byte{})),
+			}
+			return
+		}
+	}
+	if r.HTTPResponse == nil {
+		// Add a dummy request response object to ensure the HTTPResponse
+		// value is consistent.
+		r.HTTPResponse = &http.Response{
+			StatusCode: int(0),
+			Status:     http.StatusText(int(0)),
+			Body:       ioutil.NopCloser(bytes.NewReader([]byte{})),
+		}
+	}
+	// Catch all other request errors.
+	r.Error = awserr.New("RequestError", "send request failed", err)
+	r.Retryable = aws.Bool(true) // network errors are retryable
+
+	// Override the error with a context canceled error, if that was canceled.
+	ctx := r.Context()
+	select {
+	case <-ctx.Done():
+		r.Error = awserr.New(request.CanceledErrorCode,
+			"request context canceled", ctx.Err())
+		r.Retryable = aws.Bool(false)
+	default:
+	}
+}
+
+// ValidateResponseHandler is a request handler to validate service response.
+var ValidateResponseHandler = request.NamedHandler{Name: "core.ValidateResponseHandler", Fn: func(r *request.Request) {
+	if r.HTTPResponse.StatusCode == 0 || r.HTTPResponse.StatusCode >= 300 {
+		// this may be replaced by an UnmarshalError handler
+		r.Error = awserr.New("UnknownError", "unknown error", nil)
+	}
+}}
+
+// AfterRetryHandler performs final checks to determine if the request should
+// be retried and how long to delay.
+var AfterRetryHandler = request.NamedHandler{Name: "core.AfterRetryHandler", Fn: func(r *request.Request) {
+	// If one of the other handlers already set the retry state
+	// we don't want to override it based on the service's state
+	if r.Retryable == nil || aws.BoolValue(r.Config.EnforceShouldRetryCheck) {
+		r.Retryable = aws.Bool(r.ShouldRetry(r))
+	}
+
+	if r.WillRetry() {
+		r.RetryDelay = r.RetryRules(r)
+
+		if sleepFn := r.Config.SleepDelay; sleepFn != nil {
+			// Support SleepDelay for backwards compatibility and testing
+			sleepFn(r.RetryDelay)
+		} else if err := aws.SleepWithContext(r.Context(), r.RetryDelay); err != nil {
+			r.Error = awserr.New(request.CanceledErrorCode,
+				"request context canceled", err)
+			r.Retryable = aws.Bool(false)
+			return
+		}
+
+		// when the expired token exception occurs the credentials
+		// need to be expired locally so that the next request to
+		// get credentials will trigger a credentials refresh.
+		if r.IsErrorExpired() {
+			r.Config.Credentials.Expire()
+		}
+
+		r.RetryCount++
+		r.Error = nil
+	}
+}}
+
+// ValidateEndpointHandler is a request handler to validate a request had the
+// appropriate Region and Endpoint set. Will set r.Error if the endpoint or
+// region is not valid.
+var ValidateEndpointHandler = request.NamedHandler{Name: "core.ValidateEndpointHandler", Fn: func(r *request.Request) {
+	if r.ClientInfo.SigningRegion == "" && aws.StringValue(r.Config.Region) == "" {
+		r.Error = aws.ErrMissingRegion
+	} else if r.ClientInfo.Endpoint == "" {
+		r.Error = aws.ErrMissingEndpoint
+	}
+}}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/param_validator.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/param_validator.go
new file mode 100644
index 00000000..7d50b155
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/param_validator.go
@@ -0,0 +1,17 @@
+package corehandlers
+
+import "github.com/aws/aws-sdk-go/aws/request"
+
+// ValidateParametersHandler is a request handler to validate the input parameters.
+// Validating parameters only has meaning if done prior to the request being sent.
+var ValidateParametersHandler = request.NamedHandler{Name: "core.ValidateParametersHandler", Fn: func(r *request.Request) {
+	if !r.ParamsFilled() {
+		return
+	}
+
+	if v, ok := r.Params.(request.Validator); ok {
+		if err := v.Validate(); err != nil {
+			r.Error = err
+		}
+	}
+}}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/user_agent.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/user_agent.go
new file mode 100644
index 00000000..ab69c7a6
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/corehandlers/user_agent.go
@@ -0,0 +1,37 @@
+package corehandlers
+
+import (
+	"os"
+	"runtime"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/request"
+)
+
+// SDKVersionUserAgentHandler is a request handler for adding the SDK Version
+// to the user agent.
+var SDKVersionUserAgentHandler = request.NamedHandler{
+	Name: "core.SDKVersionUserAgentHandler",
+	Fn: request.MakeAddToUserAgentHandler(aws.SDKName, aws.SDKVersion,
+		runtime.Version(), runtime.GOOS, runtime.GOARCH),
+}
+
+const execEnvVar = `AWS_EXECUTION_ENV`
+const execEnvUAKey = `exec-env`
+
+// AddHostExecEnvUserAgentHander is a request handler appending the SDK's
+// execution environment to the user agent.
+//
+// If the environment variable AWS_EXECUTION_ENV is set, its value will be
+// appended to the user agent string.
+var AddHostExecEnvUserAgentHander = request.NamedHandler{
+	Name: "core.AddHostExecEnvUserAgentHander",
+	Fn: func(r *request.Request) {
+		v := os.Getenv(execEnvVar)
+		if len(v) == 0 {
+			return
+		}
+
+		request.AddToUserAgent(r, execEnvUAKey+"/"+v)
+	},
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/credentials/chain_provider.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/credentials/chain_provider.go
new file mode 100644
index 00000000..3ad1e798
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/credentials/chain_provider.go
@@ -0,0 +1,100 @@
+package credentials
+
+import (
+	"github.com/aws/aws-sdk-go/aws/awserr"
+)
+
+var (
+	// ErrNoValidProvidersFoundInChain Is returned when there are no valid
+	// providers in the ChainProvider.
+	//
+	// This has been deprecated. For verbose error messaging set
+	// aws.Config.CredentialsChainVerboseErrors to true.
+	ErrNoValidProvidersFoundInChain = awserr.New("NoCredentialProviders",
+		`no valid providers in chain. Deprecated.
+	For verbose messaging see aws.Config.CredentialsChainVerboseErrors`,
+		nil)
+)
+
+// A ChainProvider will search for a provider which returns credentials
+// and cache that provider until Retrieve is called again.
+//
+// The ChainProvider provides a way of chaining multiple providers together
+// which will pick the first available using priority order of the Providers
+// in the list.
+//
+// If none of the Providers retrieve valid credentials Value, ChainProvider's
+// Retrieve() will return the error ErrNoValidProvidersFoundInChain.
+//
+// If a Provider is found which returns valid credentials Value ChainProvider
+// will cache that Provider for all calls to IsExpired(), until Retrieve is
+// called again.
+//
+// Example of ChainProvider to be used with an EnvProvider and EC2RoleProvider.
+// In this example EnvProvider will first check if any credentials are available
+// via the environment variables. If there are none ChainProvider will check
+// the next Provider in the list, EC2RoleProvider in this case. If EC2RoleProvider
+// does not return any credentials ChainProvider will return the error
+// ErrNoValidProvidersFoundInChain
+//
+//     creds := credentials.NewChainCredentials(
+//         []credentials.Provider{
+//             &credentials.EnvProvider{},
+//             &ec2rolecreds.EC2RoleProvider{
+//                 Client: ec2metadata.New(sess),
+//             },
+//         })
+//
+//     // Usage of ChainCredentials with aws.Config
+//     svc := ec2.New(session.Must(session.NewSession(&aws.Config{
+//       Credentials: creds,
+//     })))
+//
+type ChainProvider struct {
+	Providers     []Provider
+	curr          Provider
+	VerboseErrors bool
+}
+
+// NewChainCredentials returns a pointer to a new Credentials object
+// wrapping a chain of providers.
+func NewChainCredentials(providers []Provider) *Credentials {
+	return NewCredentials(&ChainProvider{
+		Providers: append([]Provider{}, providers...),
+	})
+}
+
+// Retrieve returns the credentials value or error if no provider returned
+// without error.
+//
+// If a provider is found it will be cached and any calls to IsExpired()
+// will return the expired state of the cached provider.
+func (c *ChainProvider) Retrieve() (Value, error) {
+	var errs []error
+	for _, p := range c.Providers {
+		creds, err := p.Retrieve()
+		if err == nil {
+			c.curr = p
+			return creds, nil
+		}
+		errs = append(errs, err)
+	}
+	c.curr = nil
+
+	var err error
+	err = ErrNoValidProvidersFoundInChain
+	if c.VerboseErrors {
+		err = awserr.NewBatchError("NoCredentialProviders", "no valid providers in chain", errs)
+	}
+	return Value{}, err
+}
+
+// IsExpired will returned the expired state of the currently cached provider
+// if there is one.  If there is no current provider, true will be returned.
+func (c *ChainProvider) IsExpired() bool {
+	if c.curr != nil {
+		return c.curr.IsExpired()
+	}
+
+	return true
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/credentials/credentials.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/credentials/credentials.go
new file mode 100644
index 00000000..894bbc7f
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/credentials/credentials.go
@@ -0,0 +1,292 @@
+// Package credentials provides credential retrieval and management
+//
+// The Credentials is the primary method of getting access to and managing
+// credentials Values. Using dependency injection retrieval of the credential
+// values is handled by a object which satisfies the Provider interface.
+//
+// By default the Credentials.Get() will cache the successful result of a
+// Provider's Retrieve() until Provider.IsExpired() returns true. At which
+// point Credentials will call Provider's Retrieve() to get new credential Value.
+//
+// The Provider is responsible for determining when credentials Value have expired.
+// It is also important to note that Credentials will always call Retrieve the
+// first time Credentials.Get() is called.
+//
+// Example of using the environment variable credentials.
+//
+//     creds := credentials.NewEnvCredentials()
+//
+//     // Retrieve the credentials value
+//     credValue, err := creds.Get()
+//     if err != nil {
+//         // handle error
+//     }
+//
+// Example of forcing credentials to expire and be refreshed on the next Get().
+// This may be helpful to proactively expire credentials and refresh them sooner
+// than they would naturally expire on their own.
+//
+//     creds := credentials.NewCredentials(&ec2rolecreds.EC2RoleProvider{})
+//     creds.Expire()
+//     credsValue, err := creds.Get()
+//     // New credentials will be retrieved instead of from cache.
+//
+//
+// Custom Provider
+//
+// Each Provider built into this package also provides a helper method to generate
+// a Credentials pointer setup with the provider. To use a custom Provider just
+// create a type which satisfies the Provider interface and pass it to the
+// NewCredentials method.
+//
+//     type MyProvider struct{}
+//     func (m *MyProvider) Retrieve() (Value, error) {...}
+//     func (m *MyProvider) IsExpired() bool {...}
+//
+//     creds := credentials.NewCredentials(&MyProvider{})
+//     credValue, err := creds.Get()
+//
+package credentials
+
+import (
+	"fmt"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"sync"
+	"time"
+)
+
+// AnonymousCredentials is an empty Credential object that can be used as
+// dummy placeholder credentials for requests that do not need signed.
+//
+// This Credentials can be used to configure a service to not sign requests
+// when making service API calls. For example, when accessing public
+// s3 buckets.
+//
+//     svc := s3.New(session.Must(session.NewSession(&aws.Config{
+//       Credentials: credentials.AnonymousCredentials,
+//     })))
+//     // Access public S3 buckets.
+var AnonymousCredentials = NewStaticCredentials("", "", "")
+
+// A Value is the AWS credentials value for individual credential fields.
+type Value struct {
+	// AWS Access key ID
+	AccessKeyID string
+
+	// AWS Secret Access Key
+	SecretAccessKey string
+
+	// AWS Session Token
+	SessionToken string
+
+	// Provider used to get credentials
+	ProviderName string
+}
+
+// A Provider is the interface for any component which will provide credentials
+// Value. A provider is required to manage its own Expired state, and what to
+// be expired means.
+//
+// The Provider should not need to implement its own mutexes, because
+// that will be managed by Credentials.
+type Provider interface {
+	// Retrieve returns nil if it successfully retrieved the value.
+	// Error is returned if the value were not obtainable, or empty.
+	Retrieve() (Value, error)
+
+	// IsExpired returns if the credentials are no longer valid, and need
+	// to be retrieved.
+	IsExpired() bool
+}
+
+// An Expirer is an interface that Providers can implement to expose the expiration
+// time, if known.  If the Provider cannot accurately provide this info,
+// it should not implement this interface.
+type Expirer interface {
+	// The time at which the credentials are no longer valid
+	ExpiresAt() time.Time
+}
+
+// An ErrorProvider is a stub credentials provider that always returns an error
+// this is used by the SDK when construction a known provider is not possible
+// due to an error.
+type ErrorProvider struct {
+	// The error to be returned from Retrieve
+	Err error
+
+	// The provider name to set on the Retrieved returned Value
+	ProviderName string
+}
+
+// Retrieve will always return the error that the ErrorProvider was created with.
+func (p ErrorProvider) Retrieve() (Value, error) {
+	return Value{ProviderName: p.ProviderName}, p.Err
+}
+
+// IsExpired will always return not expired.
+func (p ErrorProvider) IsExpired() bool {
+	return false
+}
+
+// A Expiry provides shared expiration logic to be used by credentials
+// providers to implement expiry functionality.
+//
+// The best method to use this struct is as an anonymous field within the
+// provider's struct.
+//
+// Example:
+//     type EC2RoleProvider struct {
+//         Expiry
+//         ...
+//     }
+type Expiry struct {
+	// The date/time when to expire on
+	expiration time.Time
+
+	// If set will be used by IsExpired to determine the current time.
+	// Defaults to time.Now if CurrentTime is not set.  Available for testing
+	// to be able to mock out the current time.
+	CurrentTime func() time.Time
+}
+
+// SetExpiration sets the expiration IsExpired will check when called.
+//
+// If window is greater than 0 the expiration time will be reduced by the
+// window value.
+//
+// Using a window is helpful to trigger credentials to expire sooner than
+// the expiration time given to ensure no requests are made with expired
+// tokens.
+func (e *Expiry) SetExpiration(expiration time.Time, window time.Duration) {
+	e.expiration = expiration
+	if window > 0 {
+		e.expiration = e.expiration.Add(-window)
+	}
+}
+
+// IsExpired returns if the credentials are expired.
+func (e *Expiry) IsExpired() bool {
+	curTime := e.CurrentTime
+	if curTime == nil {
+		curTime = time.Now
+	}
+	return e.expiration.Before(curTime())
+}
+
+// ExpiresAt returns the expiration time of the credential
+func (e *Expiry) ExpiresAt() time.Time {
+	return e.expiration
+}
+
+// A Credentials provides concurrency safe retrieval of AWS credentials Value.
+// Credentials will cache the credentials value until they expire. Once the value
+// expires the next Get will attempt to retrieve valid credentials.
+//
+// Credentials is safe to use across multiple goroutines and will manage the
+// synchronous state so the Providers do not need to implement their own
+// synchronization.
+//
+// The first Credentials.Get() will always call Provider.Retrieve() to get the
+// first instance of the credentials Value. All calls to Get() after that
+// will return the cached credentials Value until IsExpired() returns true.
+type Credentials struct {
+	creds        Value
+	forceRefresh bool
+
+	m sync.RWMutex
+
+	provider Provider
+}
+
+// NewCredentials returns a pointer to a new Credentials with the provider set.
+func NewCredentials(provider Provider) *Credentials {
+	return &Credentials{
+		provider:     provider,
+		forceRefresh: true,
+	}
+}
+
+// Get returns the credentials value, or error if the credentials Value failed
+// to be retrieved.
+//
+// Will return the cached credentials Value if it has not expired. If the
+// credentials Value has expired the Provider's Retrieve() will be called
+// to refresh the credentials.
+//
+// If Credentials.Expire() was called the credentials Value will be force
+// expired, and the next call to Get() will cause them to be refreshed.
+func (c *Credentials) Get() (Value, error) {
+	// Check the cached credentials first with just the read lock.
+	c.m.RLock()
+	if !c.isExpired() {
+		creds := c.creds
+		c.m.RUnlock()
+		return creds, nil
+	}
+	c.m.RUnlock()
+
+	// Credentials are expired need to retrieve the credentials taking the full
+	// lock.
+	c.m.Lock()
+	defer c.m.Unlock()
+
+	if c.isExpired() {
+		creds, err := c.provider.Retrieve()
+		if err != nil {
+			return Value{}, err
+		}
+		c.creds = creds
+		c.forceRefresh = false
+	}
+
+	return c.creds, nil
+}
+
+// Expire expires the credentials and forces them to be retrieved on the
+// next call to Get().
+//
+// This will override the Provider's expired state, and force Credentials
+// to call the Provider's Retrieve().
+func (c *Credentials) Expire() {
+	c.m.Lock()
+	defer c.m.Unlock()
+
+	c.forceRefresh = true
+}
+
+// IsExpired returns if the credentials are no longer valid, and need
+// to be retrieved.
+//
+// If the Credentials were forced to be expired with Expire() this will
+// reflect that override.
+func (c *Credentials) IsExpired() bool {
+	c.m.RLock()
+	defer c.m.RUnlock()
+
+	return c.isExpired()
+}
+
+// isExpired helper method wrapping the definition of expired credentials.
+func (c *Credentials) isExpired() bool {
+	return c.forceRefresh || c.provider.IsExpired()
+}
+
+// ExpiresAt provides access to the functionality of the Expirer interface of
+// the underlying Provider, if it supports that interface.  Otherwise, it returns
+// an error.
+func (c *Credentials) ExpiresAt() (time.Time, error) {
+	c.m.RLock()
+	defer c.m.RUnlock()
+
+	expirer, ok := c.provider.(Expirer)
+	if !ok {
+		return time.Time{}, awserr.New("ProviderNotExpirer",
+			fmt.Sprintf("provider %s does not support ExpiresAt()", c.creds.ProviderName),
+			nil)
+	}
+	if c.forceRefresh {
+		// set expiration time to the distant past
+		return time.Time{}, nil
+	}
+	return expirer.ExpiresAt(), nil
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/credentials/env_provider.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/credentials/env_provider.go
new file mode 100644
index 00000000..54c5cf73
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/credentials/env_provider.go
@@ -0,0 +1,74 @@
+package credentials
+
+import (
+	"os"
+
+	"github.com/aws/aws-sdk-go/aws/awserr"
+)
+
+// EnvProviderName provides a name of Env provider
+const EnvProviderName = "EnvProvider"
+
+var (
+	// ErrAccessKeyIDNotFound is returned when the AWS Access Key ID can't be
+	// found in the process's environment.
+	ErrAccessKeyIDNotFound = awserr.New("EnvAccessKeyNotFound", "AWS_ACCESS_KEY_ID or AWS_ACCESS_KEY not found in environment", nil)
+
+	// ErrSecretAccessKeyNotFound is returned when the AWS Secret Access Key
+	// can't be found in the process's environment.
+	ErrSecretAccessKeyNotFound = awserr.New("EnvSecretNotFound", "AWS_SECRET_ACCESS_KEY or AWS_SECRET_KEY not found in environment", nil)
+)
+
+// A EnvProvider retrieves credentials from the environment variables of the
+// running process. Environment credentials never expire.
+//
+// Environment variables used:
+//
+// * Access Key ID:     AWS_ACCESS_KEY_ID or AWS_ACCESS_KEY
+//
+// * Secret Access Key: AWS_SECRET_ACCESS_KEY or AWS_SECRET_KEY
+type EnvProvider struct {
+	retrieved bool
+}
+
+// NewEnvCredentials returns a pointer to a new Credentials object
+// wrapping the environment variable provider.
+func NewEnvCredentials() *Credentials {
+	return NewCredentials(&EnvProvider{})
+}
+
+// Retrieve retrieves the keys from the environment.
+func (e *EnvProvider) Retrieve() (Value, error) {
+	e.retrieved = false
+
+	id := os.Getenv("AWS_ACCESS_KEY_ID")
+	if id == "" {
+		id = os.Getenv("AWS_ACCESS_KEY")
+	}
+
+	secret := os.Getenv("AWS_SECRET_ACCESS_KEY")
+	if secret == "" {
+		secret = os.Getenv("AWS_SECRET_KEY")
+	}
+
+	if id == "" {
+		return Value{ProviderName: EnvProviderName}, ErrAccessKeyIDNotFound
+	}
+
+	if secret == "" {
+		return Value{ProviderName: EnvProviderName}, ErrSecretAccessKeyNotFound
+	}
+
+	e.retrieved = true
+	return Value{
+		AccessKeyID:     id,
+		SecretAccessKey: secret,
+		SessionToken:    os.Getenv("AWS_SESSION_TOKEN"),
+		ProviderName:    EnvProviderName,
+	}, nil
+}
+
+// IsExpired returns if the credentials have been retrieved.
+func (e *EnvProvider) IsExpired() bool {
+	return !e.retrieved
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/credentials/example.ini b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/credentials/example.ini
new file mode 100644
index 00000000..7fc91d9d
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/credentials/example.ini
@@ -0,0 +1,12 @@
+[default]
+aws_access_key_id = accessKey
+aws_secret_access_key = secret
+aws_session_token = token
+
+[no_token]
+aws_access_key_id = accessKey
+aws_secret_access_key = secret
+
+[with_colon]
+aws_access_key_id: accessKey
+aws_secret_access_key: secret
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/credentials/shared_credentials_provider.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/credentials/shared_credentials_provider.go
new file mode 100644
index 00000000..e1551495
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/credentials/shared_credentials_provider.go
@@ -0,0 +1,150 @@
+package credentials
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/internal/ini"
+	"github.com/aws/aws-sdk-go/internal/shareddefaults"
+)
+
+// SharedCredsProviderName provides a name of SharedCreds provider
+const SharedCredsProviderName = "SharedCredentialsProvider"
+
+var (
+	// ErrSharedCredentialsHomeNotFound is emitted when the user directory cannot be found.
+	ErrSharedCredentialsHomeNotFound = awserr.New("UserHomeNotFound", "user home directory not found.", nil)
+)
+
+// A SharedCredentialsProvider retrieves credentials from the current user's home
+// directory, and keeps track if those credentials are expired.
+//
+// Profile ini file example: $HOME/.aws/credentials
+type SharedCredentialsProvider struct {
+	// Path to the shared credentials file.
+	//
+	// If empty will look for "AWS_SHARED_CREDENTIALS_FILE" env variable. If the
+	// env value is empty will default to current user's home directory.
+	// Linux/OSX: "$HOME/.aws/credentials"
+	// Windows:   "%USERPROFILE%\.aws\credentials"
+	Filename string
+
+	// AWS Profile to extract credentials from the shared credentials file. If empty
+	// will default to environment variable "AWS_PROFILE" or "default" if
+	// environment variable is also not set.
+	Profile string
+
+	// retrieved states if the credentials have been successfully retrieved.
+	retrieved bool
+}
+
+// NewSharedCredentials returns a pointer to a new Credentials object
+// wrapping the Profile file provider.
+func NewSharedCredentials(filename, profile string) *Credentials {
+	return NewCredentials(&SharedCredentialsProvider{
+		Filename: filename,
+		Profile:  profile,
+	})
+}
+
+// Retrieve reads and extracts the shared credentials from the current
+// users home directory.
+func (p *SharedCredentialsProvider) Retrieve() (Value, error) {
+	p.retrieved = false
+
+	filename, err := p.filename()
+	if err != nil {
+		return Value{ProviderName: SharedCredsProviderName}, err
+	}
+
+	creds, err := loadProfile(filename, p.profile())
+	if err != nil {
+		return Value{ProviderName: SharedCredsProviderName}, err
+	}
+
+	p.retrieved = true
+	return creds, nil
+}
+
+// IsExpired returns if the shared credentials have expired.
+func (p *SharedCredentialsProvider) IsExpired() bool {
+	return !p.retrieved
+}
+
+// loadProfiles loads from the file pointed to by shared credentials filename for profile.
+// The credentials retrieved from the profile will be returned or error. Error will be
+// returned if it fails to read from the file, or the data is invalid.
+func loadProfile(filename, profile string) (Value, error) {
+	config, err := ini.OpenFile(filename)
+	if err != nil {
+		return Value{ProviderName: SharedCredsProviderName}, awserr.New("SharedCredsLoad", "failed to load shared credentials file", err)
+	}
+
+	iniProfile, ok := config.GetSection(profile)
+	if !ok {
+		return Value{ProviderName: SharedCredsProviderName}, awserr.New("SharedCredsLoad", "failed to get profile", nil)
+	}
+
+	id := iniProfile.String("aws_access_key_id")
+	if len(id) == 0 {
+		return Value{ProviderName: SharedCredsProviderName}, awserr.New("SharedCredsAccessKey",
+			fmt.Sprintf("shared credentials %s in %s did not contain aws_access_key_id", profile, filename),
+			nil)
+	}
+
+	secret := iniProfile.String("aws_secret_access_key")
+	if len(secret) == 0 {
+		return Value{ProviderName: SharedCredsProviderName}, awserr.New("SharedCredsSecret",
+			fmt.Sprintf("shared credentials %s in %s did not contain aws_secret_access_key", profile, filename),
+			nil)
+	}
+
+	// Default to empty string if not found
+	token := iniProfile.String("aws_session_token")
+
+	return Value{
+		AccessKeyID:     id,
+		SecretAccessKey: secret,
+		SessionToken:    token,
+		ProviderName:    SharedCredsProviderName,
+	}, nil
+}
+
+// filename returns the filename to use to read AWS shared credentials.
+//
+// Will return an error if the user's home directory path cannot be found.
+func (p *SharedCredentialsProvider) filename() (string, error) {
+	if len(p.Filename) != 0 {
+		return p.Filename, nil
+	}
+
+	if p.Filename = os.Getenv("AWS_SHARED_CREDENTIALS_FILE"); len(p.Filename) != 0 {
+		return p.Filename, nil
+	}
+
+	if home := shareddefaults.UserHomeDir(); len(home) == 0 {
+		// Backwards compatibility of home directly not found error being returned.
+		// This error is too verbose, failure when opening the file would of been
+		// a better error to return.
+		return "", ErrSharedCredentialsHomeNotFound
+	}
+
+	p.Filename = shareddefaults.SharedCredentialsFilename()
+
+	return p.Filename, nil
+}
+
+// profile returns the AWS shared credentials profile.  If empty will read
+// environment variable "AWS_PROFILE". If that is not set profile will
+// return "default".
+func (p *SharedCredentialsProvider) profile() string {
+	if p.Profile == "" {
+		p.Profile = os.Getenv("AWS_PROFILE")
+	}
+	if p.Profile == "" {
+		p.Profile = "default"
+	}
+
+	return p.Profile
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/credentials/static_provider.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/credentials/static_provider.go
new file mode 100644
index 00000000..531139e3
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/credentials/static_provider.go
@@ -0,0 +1,55 @@
+package credentials
+
+import (
+	"github.com/aws/aws-sdk-go/aws/awserr"
+)
+
+// StaticProviderName provides a name of Static provider
+const StaticProviderName = "StaticProvider"
+
+var (
+	// ErrStaticCredentialsEmpty is emitted when static credentials are empty.
+	ErrStaticCredentialsEmpty = awserr.New("EmptyStaticCreds", "static credentials are empty", nil)
+)
+
+// A StaticProvider is a set of credentials which are set programmatically,
+// and will never expire.
+type StaticProvider struct {
+	Value
+}
+
+// NewStaticCredentials returns a pointer to a new Credentials object
+// wrapping a static credentials value provider.
+func NewStaticCredentials(id, secret, token string) *Credentials {
+	return NewCredentials(&StaticProvider{Value: Value{
+		AccessKeyID:     id,
+		SecretAccessKey: secret,
+		SessionToken:    token,
+	}})
+}
+
+// NewStaticCredentialsFromCreds returns a pointer to a new Credentials object
+// wrapping the static credentials value provide. Same as NewStaticCredentials
+// but takes the creds Value instead of individual fields
+func NewStaticCredentialsFromCreds(creds Value) *Credentials {
+	return NewCredentials(&StaticProvider{Value: creds})
+}
+
+// Retrieve returns the credentials or error if the credentials are invalid.
+func (s *StaticProvider) Retrieve() (Value, error) {
+	if s.AccessKeyID == "" || s.SecretAccessKey == "" {
+		return Value{ProviderName: StaticProviderName}, ErrStaticCredentialsEmpty
+	}
+
+	if len(s.Value.ProviderName) == 0 {
+		s.Value.ProviderName = StaticProviderName
+	}
+	return s.Value, nil
+}
+
+// IsExpired returns if the credentials are expired.
+//
+// For StaticProvider, the credentials never expired.
+func (s *StaticProvider) IsExpired() bool {
+	return false
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/doc.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/doc.go
new file mode 100644
index 00000000..4fcb6161
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/doc.go
@@ -0,0 +1,56 @@
+// Package aws provides the core SDK's utilities and shared types. Use this package's
+// utilities to simplify setting and reading API operations parameters.
+//
+// Value and Pointer Conversion Utilities
+//
+// This package includes a helper conversion utility for each scalar type the SDK's
+// API use. These utilities make getting a pointer of the scalar, and dereferencing
+// a pointer easier.
+//
+// Each conversion utility comes in two forms. Value to Pointer and Pointer to Value.
+// The Pointer to value will safely dereference the pointer and return its value.
+// If the pointer was nil, the scalar's zero value will be returned.
+//
+// The value to pointer functions will be named after the scalar type. So get a
+// *string from a string value use the "String" function. This makes it easy to
+// to get pointer of a literal string value, because getting the address of a
+// literal requires assigning the value to a variable first.
+//
+//    var strPtr *string
+//
+//    // Without the SDK's conversion functions
+//    str := "my string"
+//    strPtr = &str
+//
+//    // With the SDK's conversion functions
+//    strPtr = aws.String("my string")
+//
+//    // Convert *string to string value
+//    str = aws.StringValue(strPtr)
+//
+// In addition to scalars the aws package also includes conversion utilities for
+// map and slice for commonly types used in API parameters. The map and slice
+// conversion functions use similar naming pattern as the scalar conversion
+// functions.
+//
+//    var strPtrs []*string
+//    var strs []string = []string{"Go", "Gophers", "Go"}
+//
+//    // Convert []string to []*string
+//    strPtrs = aws.StringSlice(strs)
+//
+//    // Convert []*string to []string
+//    strs = aws.StringValueSlice(strPtrs)
+//
+// SDK Default HTTP Client
+//
+// The SDK will use the http.DefaultClient if a HTTP client is not provided to
+// the SDK's Session, or service client constructor. This means that if the
+// http.DefaultClient is modified by other components of your application the
+// modifications will be picked up by the SDK as well.
+//
+// In some cases this might be intended, but it is a better practice to create
+// a custom HTTP Client to share explicitly through your application. You can
+// configure the SDK to use the custom HTTP Client by setting the HTTPClient
+// value of the SDK's Config type when creating a Session or service client.
+package aws
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/api.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/api.go
new file mode 100644
index 00000000..d57a1af5
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/api.go
@@ -0,0 +1,169 @@
+package ec2metadata
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/request"
+	"github.com/aws/aws-sdk-go/internal/sdkuri"
+)
+
+// GetMetadata uses the path provided to request information from the EC2
+// instance metdata service. The content will be returned as a string, or
+// error if the request failed.
+func (c *EC2Metadata) GetMetadata(p string) (string, error) {
+	op := &request.Operation{
+		Name:       "GetMetadata",
+		HTTPMethod: "GET",
+		HTTPPath:   sdkuri.PathJoin("/meta-data", p),
+	}
+
+	output := &metadataOutput{}
+	req := c.NewRequest(op, nil, output)
+	err := req.Send()
+
+	return output.Content, err
+}
+
+// GetUserData returns the userdata that was configured for the service. If
+// there is no user-data setup for the EC2 instance a "NotFoundError" error
+// code will be returned.
+func (c *EC2Metadata) GetUserData() (string, error) {
+	op := &request.Operation{
+		Name:       "GetUserData",
+		HTTPMethod: "GET",
+		HTTPPath:   "/user-data",
+	}
+
+	output := &metadataOutput{}
+	req := c.NewRequest(op, nil, output)
+	req.Handlers.UnmarshalError.PushBack(func(r *request.Request) {
+		if r.HTTPResponse.StatusCode == http.StatusNotFound {
+			r.Error = awserr.New("NotFoundError", "user-data not found", r.Error)
+		}
+	})
+	err := req.Send()
+
+	return output.Content, err
+}
+
+// GetDynamicData uses the path provided to request information from the EC2
+// instance metadata service for dynamic data. The content will be returned
+// as a string, or error if the request failed.
+func (c *EC2Metadata) GetDynamicData(p string) (string, error) {
+	op := &request.Operation{
+		Name:       "GetDynamicData",
+		HTTPMethod: "GET",
+		HTTPPath:   sdkuri.PathJoin("/dynamic", p),
+	}
+
+	output := &metadataOutput{}
+	req := c.NewRequest(op, nil, output)
+	err := req.Send()
+
+	return output.Content, err
+}
+
+// GetInstanceIdentityDocument retrieves an identity document describing an
+// instance. Error is returned if the request fails or is unable to parse
+// the response.
+func (c *EC2Metadata) GetInstanceIdentityDocument() (EC2InstanceIdentityDocument, error) {
+	resp, err := c.GetDynamicData("instance-identity/document")
+	if err != nil {
+		return EC2InstanceIdentityDocument{},
+			awserr.New("EC2MetadataRequestError",
+				"failed to get EC2 instance identity document", err)
+	}
+
+	doc := EC2InstanceIdentityDocument{}
+	if err := json.NewDecoder(strings.NewReader(resp)).Decode(&doc); err != nil {
+		return EC2InstanceIdentityDocument{},
+			awserr.New("SerializationError",
+				"failed to decode EC2 instance identity document", err)
+	}
+
+	return doc, nil
+}
+
+// IAMInfo retrieves IAM info from the metadata API
+func (c *EC2Metadata) IAMInfo() (EC2IAMInfo, error) {
+	resp, err := c.GetMetadata("iam/info")
+	if err != nil {
+		return EC2IAMInfo{},
+			awserr.New("EC2MetadataRequestError",
+				"failed to get EC2 IAM info", err)
+	}
+
+	info := EC2IAMInfo{}
+	if err := json.NewDecoder(strings.NewReader(resp)).Decode(&info); err != nil {
+		return EC2IAMInfo{},
+			awserr.New("SerializationError",
+				"failed to decode EC2 IAM info", err)
+	}
+
+	if info.Code != "Success" {
+		errMsg := fmt.Sprintf("failed to get EC2 IAM Info (%s)", info.Code)
+		return EC2IAMInfo{},
+			awserr.New("EC2MetadataError", errMsg, nil)
+	}
+
+	return info, nil
+}
+
+// Region returns the region the instance is running in.
+func (c *EC2Metadata) Region() (string, error) {
+	resp, err := c.GetMetadata("placement/availability-zone")
+	if err != nil {
+		return "", err
+	}
+
+	if len(resp) == 0 {
+		return "", awserr.New("EC2MetadataError", "invalid Region response", nil)
+	}
+
+	// returns region without the suffix. Eg: us-west-2a becomes us-west-2
+	return resp[:len(resp)-1], nil
+}
+
+// Available returns if the application has access to the EC2 Metadata service.
+// Can be used to determine if application is running within an EC2 Instance and
+// the metadata service is available.
+func (c *EC2Metadata) Available() bool {
+	if _, err := c.GetMetadata("instance-id"); err != nil {
+		return false
+	}
+
+	return true
+}
+
+// An EC2IAMInfo provides the shape for unmarshaling
+// an IAM info from the metadata API
+type EC2IAMInfo struct {
+	Code               string
+	LastUpdated        time.Time
+	InstanceProfileArn string
+	InstanceProfileID  string
+}
+
+// An EC2InstanceIdentityDocument provides the shape for unmarshaling
+// an instance identity document
+type EC2InstanceIdentityDocument struct {
+	DevpayProductCodes []string  `json:"devpayProductCodes"`
+	AvailabilityZone   string    `json:"availabilityZone"`
+	PrivateIP          string    `json:"privateIp"`
+	Version            string    `json:"version"`
+	Region             string    `json:"region"`
+	InstanceID         string    `json:"instanceId"`
+	BillingProducts    []string  `json:"billingProducts"`
+	InstanceType       string    `json:"instanceType"`
+	AccountID          string    `json:"accountId"`
+	PendingTime        time.Time `json:"pendingTime"`
+	ImageID            string    `json:"imageId"`
+	KernelID           string    `json:"kernelId"`
+	RamdiskID          string    `json:"ramdiskId"`
+	Architecture       string    `json:"architecture"`
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/service.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/service.go
new file mode 100644
index 00000000..f4438eae
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/ec2metadata/service.go
@@ -0,0 +1,152 @@
+// Package ec2metadata provides the client for making API calls to the
+// EC2 Metadata service.
+//
+// This package's client can be disabled completely by setting the environment
+// variable "AWS_EC2_METADATA_DISABLED=true". This environment variable set to
+// true instructs the SDK to disable the EC2 Metadata client. The client cannot
+// be used while the environment variable is set to true, (case insensitive).
+package ec2metadata
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/client"
+	"github.com/aws/aws-sdk-go/aws/client/metadata"
+	"github.com/aws/aws-sdk-go/aws/corehandlers"
+	"github.com/aws/aws-sdk-go/aws/request"
+)
+
+// ServiceName is the name of the service.
+const ServiceName = "ec2metadata"
+const disableServiceEnvVar = "AWS_EC2_METADATA_DISABLED"
+
+// A EC2Metadata is an EC2 Metadata service Client.
+type EC2Metadata struct {
+	*client.Client
+}
+
+// New creates a new instance of the EC2Metadata client with a session.
+// This client is safe to use across multiple goroutines.
+//
+//
+// Example:
+//     // Create a EC2Metadata client from just a session.
+//     svc := ec2metadata.New(mySession)
+//
+//     // Create a EC2Metadata client with additional configuration
+//     svc := ec2metadata.New(mySession, aws.NewConfig().WithLogLevel(aws.LogDebugHTTPBody))
+func New(p client.ConfigProvider, cfgs ...*aws.Config) *EC2Metadata {
+	c := p.ClientConfig(ServiceName, cfgs...)
+	return NewClient(*c.Config, c.Handlers, c.Endpoint, c.SigningRegion)
+}
+
+// NewClient returns a new EC2Metadata client. Should be used to create
+// a client when not using a session. Generally using just New with a session
+// is preferred.
+//
+// If an unmodified HTTP client is provided from the stdlib default, or no client
+// the EC2RoleProvider's EC2Metadata HTTP client's timeout will be shortened.
+// To disable this set Config.EC2MetadataDisableTimeoutOverride to false. Enabled by default.
+func NewClient(cfg aws.Config, handlers request.Handlers, endpoint, signingRegion string, opts ...func(*client.Client)) *EC2Metadata {
+	if !aws.BoolValue(cfg.EC2MetadataDisableTimeoutOverride) && httpClientZero(cfg.HTTPClient) {
+		// If the http client is unmodified and this feature is not disabled
+		// set custom timeouts for EC2Metadata requests.
+		cfg.HTTPClient = &http.Client{
+			// use a shorter timeout than default because the metadata
+			// service is local if it is running, and to fail faster
+			// if not running on an ec2 instance.
+			Timeout: 5 * time.Second,
+		}
+	}
+
+	svc := &EC2Metadata{
+		Client: client.New(
+			cfg,
+			metadata.ClientInfo{
+				ServiceName: ServiceName,
+				ServiceID:   ServiceName,
+				Endpoint:    endpoint,
+				APIVersion:  "latest",
+			},
+			handlers,
+		),
+	}
+
+	svc.Handlers.Unmarshal.PushBack(unmarshalHandler)
+	svc.Handlers.UnmarshalError.PushBack(unmarshalError)
+	svc.Handlers.Validate.Clear()
+	svc.Handlers.Validate.PushBack(validateEndpointHandler)
+
+	// Disable the EC2 Metadata service if the environment variable is set.
+	// This shortcirctes the service's functionality to always fail to send
+	// requests.
+	if strings.ToLower(os.Getenv(disableServiceEnvVar)) == "true" {
+		svc.Handlers.Send.SwapNamed(request.NamedHandler{
+			Name: corehandlers.SendHandler.Name,
+			Fn: func(r *request.Request) {
+				r.HTTPResponse = &http.Response{
+					Header: http.Header{},
+				}
+				r.Error = awserr.New(
+					request.CanceledErrorCode,
+					"EC2 IMDS access disabled via "+disableServiceEnvVar+" env var",
+					nil)
+			},
+		})
+	}
+
+	// Add additional options to the service config
+	for _, option := range opts {
+		option(svc.Client)
+	}
+
+	return svc
+}
+
+func httpClientZero(c *http.Client) bool {
+	return c == nil || (c.Transport == nil && c.CheckRedirect == nil && c.Jar == nil && c.Timeout == 0)
+}
+
+type metadataOutput struct {
+	Content string
+}
+
+func unmarshalHandler(r *request.Request) {
+	defer r.HTTPResponse.Body.Close()
+	b := &bytes.Buffer{}
+	if _, err := io.Copy(b, r.HTTPResponse.Body); err != nil {
+		r.Error = awserr.New("SerializationError", "unable to unmarshal EC2 metadata respose", err)
+		return
+	}
+
+	if data, ok := r.Data.(*metadataOutput); ok {
+		data.Content = b.String()
+	}
+}
+
+func unmarshalError(r *request.Request) {
+	defer r.HTTPResponse.Body.Close()
+	b := &bytes.Buffer{}
+	if _, err := io.Copy(b, r.HTTPResponse.Body); err != nil {
+		r.Error = awserr.New("SerializationError", "unable to unmarshal EC2 metadata error respose", err)
+		return
+	}
+
+	// Response body format is not consistent between metadata endpoints.
+	// Grab the error message as a string and include that as the source error
+	r.Error = awserr.New("EC2MetadataError", "failed to make EC2Metadata request", errors.New(b.String()))
+}
+
+func validateEndpointHandler(r *request.Request) {
+	if r.ClientInfo.Endpoint == "" {
+		r.Error = aws.ErrMissingEndpoint
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/endpoints/decode.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/endpoints/decode.go
new file mode 100644
index 00000000..87b9ff3f
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/endpoints/decode.go
@@ -0,0 +1,188 @@
+package endpoints
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+
+	"github.com/aws/aws-sdk-go/aws/awserr"
+)
+
+type modelDefinition map[string]json.RawMessage
+
+// A DecodeModelOptions are the options for how the endpoints model definition
+// are decoded.
+type DecodeModelOptions struct {
+	SkipCustomizations bool
+}
+
+// Set combines all of the option functions together.
+func (d *DecodeModelOptions) Set(optFns ...func(*DecodeModelOptions)) {
+	for _, fn := range optFns {
+		fn(d)
+	}
+}
+
+// DecodeModel unmarshals a Regions and Endpoint model definition file into
+// a endpoint Resolver. If the file format is not supported, or an error occurs
+// when unmarshaling the model an error will be returned.
+//
+// Casting the return value of this func to a EnumPartitions will
+// allow you to get a list of the partitions in the order the endpoints
+// will be resolved in.
+//
+//    resolver, err := endpoints.DecodeModel(reader)
+//
+//    partitions := resolver.(endpoints.EnumPartitions).Partitions()
+//    for _, p := range partitions {
+//        // ... inspect partitions
+//    }
+func DecodeModel(r io.Reader, optFns ...func(*DecodeModelOptions)) (Resolver, error) {
+	var opts DecodeModelOptions
+	opts.Set(optFns...)
+
+	// Get the version of the partition file to determine what
+	// unmarshaling model to use.
+	modelDef := modelDefinition{}
+	if err := json.NewDecoder(r).Decode(&modelDef); err != nil {
+		return nil, newDecodeModelError("failed to decode endpoints model", err)
+	}
+
+	var version string
+	if b, ok := modelDef["version"]; ok {
+		version = string(b)
+	} else {
+		return nil, newDecodeModelError("endpoints version not found in model", nil)
+	}
+
+	if version == "3" {
+		return decodeV3Endpoints(modelDef, opts)
+	}
+
+	return nil, newDecodeModelError(
+		fmt.Sprintf("endpoints version %s, not supported", version), nil)
+}
+
+func decodeV3Endpoints(modelDef modelDefinition, opts DecodeModelOptions) (Resolver, error) {
+	b, ok := modelDef["partitions"]
+	if !ok {
+		return nil, newDecodeModelError("endpoints model missing partitions", nil)
+	}
+
+	ps := partitions{}
+	if err := json.Unmarshal(b, &ps); err != nil {
+		return nil, newDecodeModelError("failed to decode endpoints model", err)
+	}
+
+	if opts.SkipCustomizations {
+		return ps, nil
+	}
+
+	// Customization
+	for i := 0; i < len(ps); i++ {
+		p := &ps[i]
+		custAddEC2Metadata(p)
+		custAddS3DualStack(p)
+		custRmIotDataService(p)
+		custFixAppAutoscalingChina(p)
+		custFixAppAutoscalingUsGov(p)
+	}
+
+	return ps, nil
+}
+
+func custAddS3DualStack(p *partition) {
+	if p.ID != "aws" {
+		return
+	}
+
+	custAddDualstack(p, "s3")
+	custAddDualstack(p, "s3-control")
+}
+
+func custAddDualstack(p *partition, svcName string) {
+	s, ok := p.Services[svcName]
+	if !ok {
+		return
+	}
+
+	s.Defaults.HasDualStack = boxedTrue
+	s.Defaults.DualStackHostname = "{service}.dualstack.{region}.{dnsSuffix}"
+
+	p.Services[svcName] = s
+}
+
+func custAddEC2Metadata(p *partition) {
+	p.Services["ec2metadata"] = service{
+		IsRegionalized:    boxedFalse,
+		PartitionEndpoint: "aws-global",
+		Endpoints: endpoints{
+			"aws-global": endpoint{
+				Hostname:  "169.254.169.254/latest",
+				Protocols: []string{"http"},
+			},
+		},
+	}
+}
+
+func custRmIotDataService(p *partition) {
+	delete(p.Services, "data.iot")
+}
+
+func custFixAppAutoscalingChina(p *partition) {
+	if p.ID != "aws-cn" {
+		return
+	}
+
+	const serviceName = "application-autoscaling"
+	s, ok := p.Services[serviceName]
+	if !ok {
+		return
+	}
+
+	const expectHostname = `autoscaling.{region}.amazonaws.com`
+	if e, a := s.Defaults.Hostname, expectHostname; e != a {
+		fmt.Printf("custFixAppAutoscalingChina: ignoring customization, expected %s, got %s\n", e, a)
+		return
+	}
+
+	s.Defaults.Hostname = expectHostname + ".cn"
+	p.Services[serviceName] = s
+}
+
+func custFixAppAutoscalingUsGov(p *partition) {
+	if p.ID != "aws-us-gov" {
+		return
+	}
+
+	const serviceName = "application-autoscaling"
+	s, ok := p.Services[serviceName]
+	if !ok {
+		return
+	}
+
+	if a := s.Defaults.CredentialScope.Service; a != "" {
+		fmt.Printf("custFixAppAutoscalingUsGov: ignoring customization, expected empty credential scope service, got %s\n", a)
+		return
+	}
+
+	if a := s.Defaults.Hostname; a != "" {
+		fmt.Printf("custFixAppAutoscalingUsGov: ignoring customization, expected empty hostname, got %s\n", a)
+		return
+	}
+
+	s.Defaults.CredentialScope.Service = "application-autoscaling"
+	s.Defaults.Hostname = "autoscaling.{region}.amazonaws.com"
+
+	p.Services[serviceName] = s
+}
+
+type decodeModelError struct {
+	awsError
+}
+
+func newDecodeModelError(msg string, err error) decodeModelError {
+	return decodeModelError{
+		awsError: awserr.New("DecodeEndpointsModelError", msg, err),
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go
new file mode 100644
index 00000000..61bb980d
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go
@@ -0,0 +1,4103 @@
+// Code generated by aws/endpoints/v3model_codegen.go. DO NOT EDIT.
+
+package endpoints
+
+import (
+	"regexp"
+)
+
+// Partition identifiers
+const (
+	AwsPartitionID      = "aws"        // AWS Standard partition.
+	AwsCnPartitionID    = "aws-cn"     // AWS China partition.
+	AwsUsGovPartitionID = "aws-us-gov" // AWS GovCloud (US) partition.
+)
+
+// AWS Standard partition's regions.
+const (
+	ApNortheast1RegionID = "ap-northeast-1" // Asia Pacific (Tokyo).
+	ApNortheast2RegionID = "ap-northeast-2" // Asia Pacific (Seoul).
+	ApSouth1RegionID     = "ap-south-1"     // Asia Pacific (Mumbai).
+	ApSoutheast1RegionID = "ap-southeast-1" // Asia Pacific (Singapore).
+	ApSoutheast2RegionID = "ap-southeast-2" // Asia Pacific (Sydney).
+	CaCentral1RegionID   = "ca-central-1"   // Canada (Central).
+	EuCentral1RegionID   = "eu-central-1"   // EU (Frankfurt).
+	EuNorth1RegionID     = "eu-north-1"     // EU (Stockholm).
+	EuWest1RegionID      = "eu-west-1"      // EU (Ireland).
+	EuWest2RegionID      = "eu-west-2"      // EU (London).
+	EuWest3RegionID      = "eu-west-3"      // EU (Paris).
+	SaEast1RegionID      = "sa-east-1"      // South America (Sao Paulo).
+	UsEast1RegionID      = "us-east-1"      // US East (N. Virginia).
+	UsEast2RegionID      = "us-east-2"      // US East (Ohio).
+	UsWest1RegionID      = "us-west-1"      // US West (N. California).
+	UsWest2RegionID      = "us-west-2"      // US West (Oregon).
+)
+
+// AWS China partition's regions.
+const (
+	CnNorth1RegionID     = "cn-north-1"     // China (Beijing).
+	CnNorthwest1RegionID = "cn-northwest-1" // China (Ningxia).
+)
+
+// AWS GovCloud (US) partition's regions.
+const (
+	UsGovEast1RegionID = "us-gov-east-1" // AWS GovCloud (US-East).
+	UsGovWest1RegionID = "us-gov-west-1" // AWS GovCloud (US).
+)
+
+// DefaultResolver returns an Endpoint resolver that will be able
+// to resolve endpoints for: AWS Standard, AWS China, and AWS GovCloud (US).
+//
+// Use DefaultPartitions() to get the list of the default partitions.
+func DefaultResolver() Resolver {
+	return defaultPartitions
+}
+
+// DefaultPartitions returns a list of the partitions the SDK is bundled
+// with. The available partitions are: AWS Standard, AWS China, and AWS GovCloud (US).
+//
+//    partitions := endpoints.DefaultPartitions
+//    for _, p := range partitions {
+//        // ... inspect partitions
+//    }
+func DefaultPartitions() []Partition {
+	return defaultPartitions.Partitions()
+}
+
+var defaultPartitions = partitions{
+	awsPartition,
+	awscnPartition,
+	awsusgovPartition,
+}
+
+// AwsPartition returns the Resolver for AWS Standard.
+func AwsPartition() Partition {
+	return awsPartition.Partition()
+}
+
+var awsPartition = partition{
+	ID:        "aws",
+	Name:      "AWS Standard",
+	DNSSuffix: "amazonaws.com",
+	RegionRegex: regionRegex{
+		Regexp: func() *regexp.Regexp {
+			reg, _ := regexp.Compile("^(us|eu|ap|sa|ca)\\-\\w+\\-\\d+$")
+			return reg
+		}(),
+	},
+	Defaults: endpoint{
+		Hostname:          "{service}.{region}.{dnsSuffix}",
+		Protocols:         []string{"https"},
+		SignatureVersions: []string{"v4"},
+	},
+	Regions: regions{
+		"ap-northeast-1": region{
+			Description: "Asia Pacific (Tokyo)",
+		},
+		"ap-northeast-2": region{
+			Description: "Asia Pacific (Seoul)",
+		},
+		"ap-south-1": region{
+			Description: "Asia Pacific (Mumbai)",
+		},
+		"ap-southeast-1": region{
+			Description: "Asia Pacific (Singapore)",
+		},
+		"ap-southeast-2": region{
+			Description: "Asia Pacific (Sydney)",
+		},
+		"ca-central-1": region{
+			Description: "Canada (Central)",
+		},
+		"eu-central-1": region{
+			Description: "EU (Frankfurt)",
+		},
+		"eu-north-1": region{
+			Description: "EU (Stockholm)",
+		},
+		"eu-west-1": region{
+			Description: "EU (Ireland)",
+		},
+		"eu-west-2": region{
+			Description: "EU (London)",
+		},
+		"eu-west-3": region{
+			Description: "EU (Paris)",
+		},
+		"sa-east-1": region{
+			Description: "South America (Sao Paulo)",
+		},
+		"us-east-1": region{
+			Description: "US East (N. Virginia)",
+		},
+		"us-east-2": region{
+			Description: "US East (Ohio)",
+		},
+		"us-west-1": region{
+			Description: "US West (N. California)",
+		},
+		"us-west-2": region{
+			Description: "US West (Oregon)",
+		},
+	},
+	Services: services{
+		"a4b": service{
+
+			Endpoints: endpoints{
+				"us-east-1": endpoint{},
+			},
+		},
+		"acm": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"acm-pca": service{
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"api.ecr": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{
+					Hostname: "api.ecr.ap-northeast-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-northeast-1",
+					},
+				},
+				"ap-northeast-2": endpoint{
+					Hostname: "api.ecr.ap-northeast-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-northeast-2",
+					},
+				},
+				"ap-south-1": endpoint{
+					Hostname: "api.ecr.ap-south-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-south-1",
+					},
+				},
+				"ap-southeast-1": endpoint{
+					Hostname: "api.ecr.ap-southeast-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-southeast-1",
+					},
+				},
+				"ap-southeast-2": endpoint{
+					Hostname: "api.ecr.ap-southeast-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-southeast-2",
+					},
+				},
+				"ca-central-1": endpoint{
+					Hostname: "api.ecr.ca-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ca-central-1",
+					},
+				},
+				"eu-central-1": endpoint{
+					Hostname: "api.ecr.eu-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-central-1",
+					},
+				},
+				"eu-north-1": endpoint{
+					Hostname: "api.ecr.eu-north-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-north-1",
+					},
+				},
+				"eu-west-1": endpoint{
+					Hostname: "api.ecr.eu-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-west-1",
+					},
+				},
+				"eu-west-2": endpoint{
+					Hostname: "api.ecr.eu-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-west-2",
+					},
+				},
+				"eu-west-3": endpoint{
+					Hostname: "api.ecr.eu-west-3.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-west-3",
+					},
+				},
+				"sa-east-1": endpoint{
+					Hostname: "api.ecr.sa-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "sa-east-1",
+					},
+				},
+				"us-east-1": endpoint{
+					Hostname: "api.ecr.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"us-east-2": endpoint{
+					Hostname: "api.ecr.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"us-west-1": endpoint{
+					Hostname: "api.ecr.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+				},
+				"us-west-2": endpoint{
+					Hostname: "api.ecr.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+			},
+		},
+		"api.mediatailor": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"api.pricing": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "pricing",
+				},
+			},
+			Endpoints: endpoints{
+				"ap-south-1": endpoint{},
+				"us-east-1":  endpoint{},
+			},
+		},
+		"api.sagemaker": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-1-fips": endpoint{
+					Hostname: "api-fips.sagemaker.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"us-east-2": endpoint{},
+				"us-east-2-fips": endpoint{
+					Hostname: "api-fips.sagemaker.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"us-west-1": endpoint{},
+				"us-west-1-fips": endpoint{
+					Hostname: "api-fips.sagemaker.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+				},
+				"us-west-2": endpoint{},
+				"us-west-2-fips": endpoint{
+					Hostname: "api-fips.sagemaker.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+			},
+		},
+		"apigateway": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"application-autoscaling": service{
+			Defaults: endpoint{
+				Hostname:  "autoscaling.{region}.amazonaws.com",
+				Protocols: []string{"http", "https"},
+				CredentialScope: credentialScope{
+					Service: "application-autoscaling",
+				},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"appstream2": service{
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+				CredentialScope: credentialScope{
+					Service: "appstream",
+				},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"appsync": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"athena": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"autoscaling": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"autoscaling-plans": service{
+			Defaults: endpoint{
+				Hostname:  "autoscaling.{region}.amazonaws.com",
+				Protocols: []string{"http", "https"},
+				CredentialScope: credentialScope{
+					Service: "autoscaling-plans",
+				},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"batch": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"budgets": service{
+			PartitionEndpoint: "aws-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-global": endpoint{
+					Hostname: "budgets.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+			},
+		},
+		"ce": service{
+			PartitionEndpoint: "aws-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-global": endpoint{
+					Hostname: "ce.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+			},
+		},
+		"chime": service{
+			PartitionEndpoint: "aws-global",
+			IsRegionalized:    boxedFalse,
+			Defaults: endpoint{
+				SSLCommonName: "service.chime.aws.amazon.com",
+				Protocols:     []string{"https"},
+			},
+			Endpoints: endpoints{
+				"aws-global": endpoint{
+					Hostname:  "service.chime.aws.amazon.com",
+					Protocols: []string{"https"},
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+			},
+		},
+		"cloud9": service{
+
+			Endpoints: endpoints{
+				"ap-southeast-1": endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"clouddirectory": service{
+
+			Endpoints: endpoints{
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"cloudformation": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"cloudfront": service{
+			PartitionEndpoint: "aws-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-global": endpoint{
+					Hostname:  "cloudfront.amazonaws.com",
+					Protocols: []string{"http", "https"},
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+			},
+		},
+		"cloudhsm": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"cloudhsmv2": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "cloudhsm",
+				},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"cloudsearch": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"cloudtrail": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"codebuild": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-1-fips": endpoint{
+					Hostname: "codebuild-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"us-east-2": endpoint{},
+				"us-east-2-fips": endpoint{
+					Hostname: "codebuild-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"us-west-1": endpoint{},
+				"us-west-1-fips": endpoint{
+					Hostname: "codebuild-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+				},
+				"us-west-2": endpoint{},
+				"us-west-2-fips": endpoint{
+					Hostname: "codebuild-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+			},
+		},
+		"codecommit": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"fips": endpoint{
+					Hostname: "codecommit-fips.ca-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ca-central-1",
+					},
+				},
+				"sa-east-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-east-2": endpoint{},
+				"us-west-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"codedeploy": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-1-fips": endpoint{
+					Hostname: "codedeploy-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"us-east-2": endpoint{},
+				"us-east-2-fips": endpoint{
+					Hostname: "codedeploy-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"us-west-1": endpoint{},
+				"us-west-1-fips": endpoint{
+					Hostname: "codedeploy-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+				},
+				"us-west-2": endpoint{},
+				"us-west-2-fips": endpoint{
+					Hostname: "codedeploy-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+			},
+		},
+		"codepipeline": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"codestar": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"cognito-identity": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"cognito-idp": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"cognito-sync": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"comprehend": service{
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"comprehendmedical": service{
+
+			Endpoints: endpoints{
+				"eu-west-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-east-2": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"config": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"cur": service{
+
+			Endpoints: endpoints{
+				"us-east-1": endpoint{},
+			},
+		},
+		"datapipeline": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"datasync": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"dax": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"devicefarm": service{
+
+			Endpoints: endpoints{
+				"us-west-2": endpoint{},
+			},
+		},
+		"directconnect": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"discovery": service{
+
+			Endpoints: endpoints{
+				"us-west-2": endpoint{},
+			},
+		},
+		"dms": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"docdb": service{
+
+			Endpoints: endpoints{
+				"eu-west-1": endpoint{
+					Hostname: "rds.eu-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-west-1",
+					},
+				},
+				"us-east-1": endpoint{
+					Hostname: "rds.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"us-east-2": endpoint{
+					Hostname: "rds.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"us-west-2": endpoint{
+					Hostname: "rds.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+			},
+		},
+		"ds": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"dynamodb": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"local": endpoint{
+					Hostname:  "localhost:8000",
+					Protocols: []string{"http"},
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"sa-east-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-east-2": endpoint{},
+				"us-west-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"ec2": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"ec2metadata": service{
+			PartitionEndpoint: "aws-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-global": endpoint{
+					Hostname:  "169.254.169.254/latest",
+					Protocols: []string{"http"},
+				},
+			},
+		},
+		"ecs": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"elasticache": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"fips": endpoint{
+					Hostname: "elasticache-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+				},
+				"sa-east-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-east-2": endpoint{},
+				"us-west-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"elasticbeanstalk": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"elasticfilesystem": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"elasticloadbalancing": service{
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"elasticmapreduce": service{
+			Defaults: endpoint{
+				SSLCommonName: "{region}.{service}.{dnsSuffix}",
+				Protocols:     []string{"https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1": endpoint{
+					SSLCommonName: "{service}.{region}.{dnsSuffix}",
+				},
+				"eu-north-1": endpoint{},
+				"eu-west-1":  endpoint{},
+				"eu-west-2":  endpoint{},
+				"eu-west-3":  endpoint{},
+				"sa-east-1":  endpoint{},
+				"us-east-1": endpoint{
+					SSLCommonName: "{service}.{region}.{dnsSuffix}",
+				},
+				"us-east-2": endpoint{},
+				"us-west-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"elastictranscoder": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"email": service{
+
+			Endpoints: endpoints{
+				"eu-west-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"entitlement.marketplace": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "aws-marketplace",
+				},
+			},
+			Endpoints: endpoints{
+				"us-east-1": endpoint{},
+			},
+		},
+		"es": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"fips": endpoint{
+					Hostname: "es-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+				},
+				"sa-east-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-east-2": endpoint{},
+				"us-west-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"events": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"firehose": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"fms": service{
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"fsx": service{
+
+			Endpoints: endpoints{
+				"eu-west-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-east-2": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"gamelift": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"glacier": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"glue": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"greengrass": service{
+			IsRegionalized: boxedTrue,
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"guardduty": service{
+			IsRegionalized: boxedTrue,
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"health": service{
+
+			Endpoints: endpoints{
+				"us-east-1": endpoint{},
+			},
+		},
+		"iam": service{
+			PartitionEndpoint: "aws-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-global": endpoint{
+					Hostname: "iam.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+			},
+		},
+		"importexport": service{
+			PartitionEndpoint: "aws-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-global": endpoint{
+					Hostname:          "importexport.amazonaws.com",
+					SignatureVersions: []string{"v2", "v4"},
+					CredentialScope: credentialScope{
+						Region:  "us-east-1",
+						Service: "IngestionService",
+					},
+				},
+			},
+		},
+		"inspector": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"iot": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "execute-api",
+				},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"iotanalytics": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"kinesis": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"kinesisanalytics": service{
+
+			Endpoints: endpoints{
+				"eu-central-1": endpoint{},
+				"eu-west-1":    endpoint{},
+				"us-east-1":    endpoint{},
+				"us-east-2":    endpoint{},
+				"us-west-2":    endpoint{},
+			},
+		},
+		"kinesisvideo": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"kms": service{
+
+			Endpoints: endpoints{
+				"ProdFips": endpoint{
+					Hostname: "kms-fips.ca-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ca-central-1",
+					},
+				},
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"lambda": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"license-manager": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"lightsail": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"logs": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"machinelearning": service{
+
+			Endpoints: endpoints{
+				"eu-west-1": endpoint{},
+				"us-east-1": endpoint{},
+			},
+		},
+		"marketplacecommerceanalytics": service{
+
+			Endpoints: endpoints{
+				"us-east-1": endpoint{},
+			},
+		},
+		"mediaconvert": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"medialive": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"mediapackage": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"mediastore": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"metering.marketplace": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "aws-marketplace",
+				},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"mgh": service{
+
+			Endpoints: endpoints{
+				"us-west-2": endpoint{},
+			},
+		},
+		"mobileanalytics": service{
+
+			Endpoints: endpoints{
+				"us-east-1": endpoint{},
+			},
+		},
+		"models.lex": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "lex",
+				},
+			},
+			Endpoints: endpoints{
+				"eu-west-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"monitoring": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"mq": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"mturk-requester": service{
+			IsRegionalized: boxedFalse,
+
+			Endpoints: endpoints{
+				"sandbox": endpoint{
+					Hostname: "mturk-requester-sandbox.us-east-1.amazonaws.com",
+				},
+				"us-east-1": endpoint{},
+			},
+		},
+		"neptune": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{
+					Hostname: "rds.ap-northeast-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-northeast-1",
+					},
+				},
+				"ap-southeast-1": endpoint{
+					Hostname: "rds.ap-southeast-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-southeast-1",
+					},
+				},
+				"ap-southeast-2": endpoint{
+					Hostname: "rds.ap-southeast-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-southeast-2",
+					},
+				},
+				"eu-central-1": endpoint{
+					Hostname: "rds.eu-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-central-1",
+					},
+				},
+				"eu-west-1": endpoint{
+					Hostname: "rds.eu-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-west-1",
+					},
+				},
+				"eu-west-2": endpoint{
+					Hostname: "rds.eu-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "eu-west-2",
+					},
+				},
+				"us-east-1": endpoint{
+					Hostname: "rds.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"us-east-2": endpoint{
+					Hostname: "rds.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"us-west-2": endpoint{
+					Hostname: "rds.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+			},
+		},
+		"opsworks": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"opsworks-cm": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"organizations": service{
+			PartitionEndpoint: "aws-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-global": endpoint{
+					Hostname: "organizations.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+			},
+		},
+		"pinpoint": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "mobiletargeting",
+				},
+			},
+			Endpoints: endpoints{
+				"eu-central-1": endpoint{},
+				"eu-west-1":    endpoint{},
+				"us-east-1":    endpoint{},
+				"us-west-2":    endpoint{},
+			},
+		},
+		"polly": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"rds": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1": endpoint{
+					SSLCommonName: "{service}.{dnsSuffix}",
+				},
+				"us-east-2": endpoint{},
+				"us-west-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"redshift": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"rekognition": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"resource-groups": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"robomaker": service{
+
+			Endpoints: endpoints{
+				"eu-west-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"route53": service{
+			PartitionEndpoint: "aws-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-global": endpoint{
+					Hostname: "route53.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+			},
+		},
+		"route53domains": service{
+
+			Endpoints: endpoints{
+				"us-east-1": endpoint{},
+			},
+		},
+		"route53resolver": service{
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"runtime.lex": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "lex",
+				},
+			},
+			Endpoints: endpoints{
+				"eu-west-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"runtime.sagemaker": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"s3": service{
+			PartitionEndpoint: "us-east-1",
+			IsRegionalized:    boxedTrue,
+			Defaults: endpoint{
+				Protocols:         []string{"http", "https"},
+				SignatureVersions: []string{"s3v4"},
+
+				HasDualStack:      boxedTrue,
+				DualStackHostname: "{service}.dualstack.{region}.{dnsSuffix}",
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{
+					Hostname:          "s3.ap-northeast-1.amazonaws.com",
+					SignatureVersions: []string{"s3", "s3v4"},
+				},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{
+					Hostname:          "s3.ap-southeast-1.amazonaws.com",
+					SignatureVersions: []string{"s3", "s3v4"},
+				},
+				"ap-southeast-2": endpoint{
+					Hostname:          "s3.ap-southeast-2.amazonaws.com",
+					SignatureVersions: []string{"s3", "s3v4"},
+				},
+				"ca-central-1": endpoint{},
+				"eu-central-1": endpoint{},
+				"eu-north-1":   endpoint{},
+				"eu-west-1": endpoint{
+					Hostname:          "s3.eu-west-1.amazonaws.com",
+					SignatureVersions: []string{"s3", "s3v4"},
+				},
+				"eu-west-2": endpoint{},
+				"eu-west-3": endpoint{},
+				"s3-external-1": endpoint{
+					Hostname:          "s3-external-1.amazonaws.com",
+					SignatureVersions: []string{"s3", "s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"sa-east-1": endpoint{
+					Hostname:          "s3.sa-east-1.amazonaws.com",
+					SignatureVersions: []string{"s3", "s3v4"},
+				},
+				"us-east-1": endpoint{
+					Hostname:          "s3.amazonaws.com",
+					SignatureVersions: []string{"s3", "s3v4"},
+				},
+				"us-east-2": endpoint{},
+				"us-west-1": endpoint{
+					Hostname:          "s3.us-west-1.amazonaws.com",
+					SignatureVersions: []string{"s3", "s3v4"},
+				},
+				"us-west-2": endpoint{
+					Hostname:          "s3.us-west-2.amazonaws.com",
+					SignatureVersions: []string{"s3", "s3v4"},
+				},
+			},
+		},
+		"s3-control": service{
+			Defaults: endpoint{
+				Protocols:         []string{"https"},
+				SignatureVersions: []string{"s3v4"},
+
+				HasDualStack:      boxedTrue,
+				DualStackHostname: "{service}.dualstack.{region}.{dnsSuffix}",
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{
+					Hostname:          "s3-control.ap-northeast-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "ap-northeast-1",
+					},
+				},
+				"ap-northeast-2": endpoint{
+					Hostname:          "s3-control.ap-northeast-2.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "ap-northeast-2",
+					},
+				},
+				"ap-south-1": endpoint{
+					Hostname:          "s3-control.ap-south-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "ap-south-1",
+					},
+				},
+				"ap-southeast-1": endpoint{
+					Hostname:          "s3-control.ap-southeast-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "ap-southeast-1",
+					},
+				},
+				"ap-southeast-2": endpoint{
+					Hostname:          "s3-control.ap-southeast-2.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "ap-southeast-2",
+					},
+				},
+				"ca-central-1": endpoint{
+					Hostname:          "s3-control.ca-central-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "ca-central-1",
+					},
+				},
+				"eu-central-1": endpoint{
+					Hostname:          "s3-control.eu-central-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "eu-central-1",
+					},
+				},
+				"eu-north-1": endpoint{
+					Hostname:          "s3-control.eu-north-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "eu-north-1",
+					},
+				},
+				"eu-west-1": endpoint{
+					Hostname:          "s3-control.eu-west-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "eu-west-1",
+					},
+				},
+				"eu-west-2": endpoint{
+					Hostname:          "s3-control.eu-west-2.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "eu-west-2",
+					},
+				},
+				"eu-west-3": endpoint{
+					Hostname:          "s3-control.eu-west-3.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "eu-west-3",
+					},
+				},
+				"sa-east-1": endpoint{
+					Hostname:          "s3-control.sa-east-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "sa-east-1",
+					},
+				},
+				"us-east-1": endpoint{
+					Hostname:          "s3-control.us-east-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"us-east-1-fips": endpoint{
+					Hostname:          "s3-control-fips.us-east-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"us-east-2": endpoint{
+					Hostname:          "s3-control.us-east-2.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"us-east-2-fips": endpoint{
+					Hostname:          "s3-control-fips.us-east-2.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"us-west-1": endpoint{
+					Hostname:          "s3-control.us-west-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+				},
+				"us-west-1-fips": endpoint{
+					Hostname:          "s3-control-fips.us-west-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+				},
+				"us-west-2": endpoint{
+					Hostname:          "s3-control.us-west-2.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+				"us-west-2-fips": endpoint{
+					Hostname:          "s3-control-fips.us-west-2.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+			},
+		},
+		"sdb": service{
+			Defaults: endpoint{
+				Protocols:         []string{"http", "https"},
+				SignatureVersions: []string{"v2"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-west-1":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1": endpoint{
+					Hostname: "sdb.amazonaws.com",
+				},
+				"us-west-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"secretsmanager": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-1-fips": endpoint{
+					Hostname: "secretsmanager-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"us-east-2": endpoint{},
+				"us-east-2-fips": endpoint{
+					Hostname: "secretsmanager-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"us-west-1": endpoint{},
+				"us-west-1-fips": endpoint{
+					Hostname: "secretsmanager-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+				},
+				"us-west-2": endpoint{},
+				"us-west-2-fips": endpoint{
+					Hostname: "secretsmanager-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+			},
+		},
+		"securityhub": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"serverlessrepo": service{
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{
+					Protocols: []string{"https"},
+				},
+				"ap-northeast-2": endpoint{
+					Protocols: []string{"https"},
+				},
+				"ap-south-1": endpoint{
+					Protocols: []string{"https"},
+				},
+				"ap-southeast-1": endpoint{
+					Protocols: []string{"https"},
+				},
+				"ap-southeast-2": endpoint{
+					Protocols: []string{"https"},
+				},
+				"ca-central-1": endpoint{
+					Protocols: []string{"https"},
+				},
+				"eu-central-1": endpoint{
+					Protocols: []string{"https"},
+				},
+				"eu-west-1": endpoint{
+					Protocols: []string{"https"},
+				},
+				"eu-west-2": endpoint{
+					Protocols: []string{"https"},
+				},
+				"sa-east-1": endpoint{
+					Protocols: []string{"https"},
+				},
+				"us-east-1": endpoint{
+					Protocols: []string{"https"},
+				},
+				"us-east-2": endpoint{
+					Protocols: []string{"https"},
+				},
+				"us-west-1": endpoint{
+					Protocols: []string{"https"},
+				},
+				"us-west-2": endpoint{
+					Protocols: []string{"https"},
+				},
+			},
+		},
+		"servicecatalog": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-1-fips": endpoint{
+					Hostname: "servicecatalog-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"us-east-2": endpoint{},
+				"us-east-2-fips": endpoint{
+					Hostname: "servicecatalog-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"us-west-1": endpoint{},
+				"us-west-1-fips": endpoint{
+					Hostname: "servicecatalog-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+				},
+				"us-west-2": endpoint{},
+				"us-west-2-fips": endpoint{
+					Hostname: "servicecatalog-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+			},
+		},
+		"servicediscovery": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"shield": service{
+			IsRegionalized: boxedFalse,
+			Defaults: endpoint{
+				SSLCommonName: "shield.us-east-1.amazonaws.com",
+				Protocols:     []string{"https"},
+			},
+			Endpoints: endpoints{
+				"us-east-1": endpoint{},
+			},
+		},
+		"sms": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"snowball": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"sns": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"sqs": service{
+			Defaults: endpoint{
+				SSLCommonName: "{region}.queue.{dnsSuffix}",
+				Protocols:     []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"fips-us-east-1": endpoint{
+					Hostname: "sqs-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"fips-us-east-2": endpoint{
+					Hostname: "sqs-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"fips-us-west-1": endpoint{
+					Hostname: "sqs-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+				},
+				"fips-us-west-2": endpoint{
+					Hostname: "sqs-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+				"sa-east-1": endpoint{},
+				"us-east-1": endpoint{
+					SSLCommonName: "queue.{dnsSuffix}",
+				},
+				"us-east-2": endpoint{},
+				"us-west-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"ssm": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"states": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"storagegateway": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"streams.dynamodb": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+				CredentialScope: credentialScope{
+					Service: "dynamodb",
+				},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"local": endpoint{
+					Hostname:  "localhost:8000",
+					Protocols: []string{"http"},
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"sa-east-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-east-2": endpoint{},
+				"us-west-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"sts": service{
+			PartitionEndpoint: "aws-global",
+			Defaults: endpoint{
+				Hostname: "sts.amazonaws.com",
+				CredentialScope: credentialScope{
+					Region: "us-east-1",
+				},
+			},
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{
+					Hostname: "sts.ap-northeast-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-northeast-2",
+					},
+				},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"aws-global":     endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-1-fips": endpoint{
+					Hostname: "sts-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"us-east-2": endpoint{},
+				"us-east-2-fips": endpoint{
+					Hostname: "sts-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"us-west-1": endpoint{},
+				"us-west-1-fips": endpoint{
+					Hostname: "sts-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+				},
+				"us-west-2": endpoint{},
+				"us-west-2-fips": endpoint{
+					Hostname: "sts-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+			},
+		},
+		"support": service{
+
+			Endpoints: endpoints{
+				"us-east-1": endpoint{},
+			},
+		},
+		"swf": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"tagging": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"transfer": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"translate": service{
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"eu-west-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-east-1-fips": endpoint{
+					Hostname: "translate-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				"us-east-2": endpoint{},
+				"us-east-2-fips": endpoint{
+					Hostname: "translate-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+				},
+				"us-west-2": endpoint{},
+				"us-west-2-fips": endpoint{
+					Hostname: "translate-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+			},
+		},
+		"waf": service{
+			PartitionEndpoint: "aws-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-global": endpoint{
+					Hostname: "waf.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+			},
+		},
+		"waf-regional": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"workdocs": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"eu-west-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"workmail": service{
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"eu-west-1": endpoint{},
+				"us-east-1": endpoint{},
+				"us-west-2": endpoint{},
+			},
+		},
+		"workspaces": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+		"xray": service{
+
+			Endpoints: endpoints{
+				"ap-northeast-1": endpoint{},
+				"ap-northeast-2": endpoint{},
+				"ap-south-1":     endpoint{},
+				"ap-southeast-1": endpoint{},
+				"ap-southeast-2": endpoint{},
+				"ca-central-1":   endpoint{},
+				"eu-central-1":   endpoint{},
+				"eu-north-1":     endpoint{},
+				"eu-west-1":      endpoint{},
+				"eu-west-2":      endpoint{},
+				"eu-west-3":      endpoint{},
+				"sa-east-1":      endpoint{},
+				"us-east-1":      endpoint{},
+				"us-east-2":      endpoint{},
+				"us-west-1":      endpoint{},
+				"us-west-2":      endpoint{},
+			},
+		},
+	},
+}
+
+// AwsCnPartition returns the Resolver for AWS China.
+func AwsCnPartition() Partition {
+	return awscnPartition.Partition()
+}
+
+var awscnPartition = partition{
+	ID:        "aws-cn",
+	Name:      "AWS China",
+	DNSSuffix: "amazonaws.com.cn",
+	RegionRegex: regionRegex{
+		Regexp: func() *regexp.Regexp {
+			reg, _ := regexp.Compile("^cn\\-\\w+\\-\\d+$")
+			return reg
+		}(),
+	},
+	Defaults: endpoint{
+		Hostname:          "{service}.{region}.{dnsSuffix}",
+		Protocols:         []string{"https"},
+		SignatureVersions: []string{"v4"},
+	},
+	Regions: regions{
+		"cn-north-1": region{
+			Description: "China (Beijing)",
+		},
+		"cn-northwest-1": region{
+			Description: "China (Ningxia)",
+		},
+	},
+	Services: services{
+		"api.ecr": service{
+
+			Endpoints: endpoints{
+				"cn-north-1": endpoint{
+					Hostname: "api.ecr.cn-north-1.amazonaws.com.cn",
+					CredentialScope: credentialScope{
+						Region: "cn-north-1",
+					},
+				},
+				"cn-northwest-1": endpoint{
+					Hostname: "api.ecr.cn-northwest-1.amazonaws.com.cn",
+					CredentialScope: credentialScope{
+						Region: "cn-northwest-1",
+					},
+				},
+			},
+		},
+		"apigateway": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"application-autoscaling": service{
+			Defaults: endpoint{
+				Hostname:  "autoscaling.{region}.amazonaws.com.cn",
+				Protocols: []string{"http", "https"},
+				CredentialScope: credentialScope{
+					Service: "application-autoscaling",
+				},
+			},
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"autoscaling": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"cloudformation": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"cloudtrail": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"codebuild": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"codedeploy": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"cognito-identity": service{
+
+			Endpoints: endpoints{
+				"cn-north-1": endpoint{},
+			},
+		},
+		"config": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"directconnect": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"dms": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"ds": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"dynamodb": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"ec2": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"ec2metadata": service{
+			PartitionEndpoint: "aws-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-global": endpoint{
+					Hostname:  "169.254.169.254/latest",
+					Protocols: []string{"http"},
+				},
+			},
+		},
+		"ecs": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"elasticache": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"elasticbeanstalk": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"elasticloadbalancing": service{
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"elasticmapreduce": service{
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"es": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"events": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"firehose": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"gamelift": service{
+
+			Endpoints: endpoints{
+				"cn-north-1": endpoint{},
+			},
+		},
+		"glacier": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"iam": service{
+			PartitionEndpoint: "aws-cn-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-cn-global": endpoint{
+					Hostname: "iam.cn-north-1.amazonaws.com.cn",
+					CredentialScope: credentialScope{
+						Region: "cn-north-1",
+					},
+				},
+			},
+		},
+		"iot": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "execute-api",
+				},
+			},
+			Endpoints: endpoints{
+				"cn-north-1": endpoint{},
+			},
+		},
+		"kinesis": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"lambda": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"logs": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"monitoring": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"polly": service{
+
+			Endpoints: endpoints{
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"rds": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"redshift": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"s3": service{
+			Defaults: endpoint{
+				Protocols:         []string{"http", "https"},
+				SignatureVersions: []string{"s3v4"},
+			},
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"s3-control": service{
+			Defaults: endpoint{
+				Protocols:         []string{"https"},
+				SignatureVersions: []string{"s3v4"},
+			},
+			Endpoints: endpoints{
+				"cn-north-1": endpoint{
+					Hostname:          "s3-control.cn-north-1.amazonaws.com.cn",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "cn-north-1",
+					},
+				},
+				"cn-northwest-1": endpoint{
+					Hostname:          "s3-control.cn-northwest-1.amazonaws.com.cn",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "cn-northwest-1",
+					},
+				},
+			},
+		},
+		"sms": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"snowball": service{
+
+			Endpoints: endpoints{
+				"cn-north-1": endpoint{},
+			},
+		},
+		"sns": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"sqs": service{
+			Defaults: endpoint{
+				SSLCommonName: "{region}.queue.{dnsSuffix}",
+				Protocols:     []string{"http", "https"},
+			},
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"ssm": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"states": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"storagegateway": service{
+
+			Endpoints: endpoints{
+				"cn-north-1": endpoint{},
+			},
+		},
+		"streams.dynamodb": service{
+			Defaults: endpoint{
+				Protocols: []string{"http", "https"},
+				CredentialScope: credentialScope{
+					Service: "dynamodb",
+				},
+			},
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"sts": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"swf": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+		"tagging": service{
+
+			Endpoints: endpoints{
+				"cn-north-1":     endpoint{},
+				"cn-northwest-1": endpoint{},
+			},
+		},
+	},
+}
+
+// AwsUsGovPartition returns the Resolver for AWS GovCloud (US).
+func AwsUsGovPartition() Partition {
+	return awsusgovPartition.Partition()
+}
+
+var awsusgovPartition = partition{
+	ID:        "aws-us-gov",
+	Name:      "AWS GovCloud (US)",
+	DNSSuffix: "amazonaws.com",
+	RegionRegex: regionRegex{
+		Regexp: func() *regexp.Regexp {
+			reg, _ := regexp.Compile("^us\\-gov\\-\\w+\\-\\d+$")
+			return reg
+		}(),
+	},
+	Defaults: endpoint{
+		Hostname:          "{service}.{region}.{dnsSuffix}",
+		Protocols:         []string{"https"},
+		SignatureVersions: []string{"v4"},
+	},
+	Regions: regions{
+		"us-gov-east-1": region{
+			Description: "AWS GovCloud (US-East)",
+		},
+		"us-gov-west-1": region{
+			Description: "AWS GovCloud (US)",
+		},
+	},
+	Services: services{
+		"acm": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"api.ecr": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{
+					Hostname: "api.ecr.us-gov-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-east-1",
+					},
+				},
+				"us-gov-west-1": endpoint{
+					Hostname: "api.ecr.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+			},
+		},
+		"api.sagemaker": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"apigateway": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"application-autoscaling": service{
+			Defaults: endpoint{
+				Hostname: "autoscaling.{region}.amazonaws.com",
+				CredentialScope: credentialScope{
+					Service: "application-autoscaling",
+				},
+			},
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"athena": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"autoscaling": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{
+					Protocols: []string{"http", "https"},
+				},
+			},
+		},
+		"clouddirectory": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"cloudformation": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"cloudhsm": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"cloudhsmv2": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "cloudhsm",
+				},
+			},
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"cloudtrail": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"codedeploy": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-east-1-fips": endpoint{
+					Hostname: "codedeploy-fips.us-gov-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-east-1",
+					},
+				},
+				"us-gov-west-1": endpoint{},
+				"us-gov-west-1-fips": endpoint{
+					Hostname: "codedeploy-fips.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+			},
+		},
+		"config": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"directconnect": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"dms": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"ds": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"dynamodb": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+				"us-gov-west-1-fips": endpoint{
+					Hostname: "dynamodb.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+			},
+		},
+		"ec2": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"ec2metadata": service{
+			PartitionEndpoint: "aws-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-global": endpoint{
+					Hostname:  "169.254.169.254/latest",
+					Protocols: []string{"http"},
+				},
+			},
+		},
+		"ecs": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"elasticache": service{
+
+			Endpoints: endpoints{
+				"fips": endpoint{
+					Hostname: "elasticache-fips.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"elasticbeanstalk": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"elasticfilesystem": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"elasticloadbalancing": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{
+					Protocols: []string{"http", "https"},
+				},
+			},
+		},
+		"elasticmapreduce": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{
+					Protocols: []string{"https"},
+				},
+			},
+		},
+		"es": service{
+
+			Endpoints: endpoints{
+				"fips": endpoint{
+					Hostname: "es-fips.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"events": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"firehose": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"glacier": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{
+					Protocols: []string{"http", "https"},
+				},
+			},
+		},
+		"glue": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"guardduty": service{
+			IsRegionalized: boxedTrue,
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"iam": service{
+			PartitionEndpoint: "aws-us-gov-global",
+			IsRegionalized:    boxedFalse,
+
+			Endpoints: endpoints{
+				"aws-us-gov-global": endpoint{
+					Hostname: "iam.us-gov.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+			},
+		},
+		"inspector": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"iot": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "execute-api",
+				},
+			},
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"kinesis": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"kms": service{
+
+			Endpoints: endpoints{
+				"ProdFips": endpoint{
+					Hostname: "kms-fips.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"lambda": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"logs": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"mediaconvert": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"metering.marketplace": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "aws-marketplace",
+				},
+			},
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"monitoring": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"polly": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"rds": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"redshift": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"rekognition": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"runtime.sagemaker": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"s3": service{
+			Defaults: endpoint{
+				SignatureVersions: []string{"s3", "s3v4"},
+			},
+			Endpoints: endpoints{
+				"fips-us-gov-west-1": endpoint{
+					Hostname: "s3-fips-us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+				"us-gov-east-1": endpoint{
+					Hostname:  "s3.us-gov-east-1.amazonaws.com",
+					Protocols: []string{"http", "https"},
+				},
+				"us-gov-west-1": endpoint{
+					Hostname:  "s3.us-gov-west-1.amazonaws.com",
+					Protocols: []string{"http", "https"},
+				},
+			},
+		},
+		"s3-control": service{
+			Defaults: endpoint{
+				Protocols:         []string{"https"},
+				SignatureVersions: []string{"s3v4"},
+			},
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{
+					Hostname:          "s3-control.us-gov-east-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-gov-east-1",
+					},
+				},
+				"us-gov-east-1-fips": endpoint{
+					Hostname:          "s3-control-fips.us-gov-east-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-gov-east-1",
+					},
+				},
+				"us-gov-west-1": endpoint{
+					Hostname:          "s3-control.us-gov-west-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+				"us-gov-west-1-fips": endpoint{
+					Hostname:          "s3-control-fips.us-gov-west-1.amazonaws.com",
+					SignatureVersions: []string{"s3v4"},
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+			},
+		},
+		"sms": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"snowball": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"sns": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{
+					Protocols: []string{"http", "https"},
+				},
+			},
+		},
+		"sqs": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{
+					SSLCommonName: "{region}.queue.{dnsSuffix}",
+					Protocols:     []string{"http", "https"},
+				},
+			},
+		},
+		"ssm": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"states": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"storagegateway": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"streams.dynamodb": service{
+			Defaults: endpoint{
+				CredentialScope: credentialScope{
+					Service: "dynamodb",
+				},
+			},
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+				"us-gov-west-1-fips": endpoint{
+					Hostname: "dynamodb.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+			},
+		},
+		"sts": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"swf": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"tagging": service{
+
+			Endpoints: endpoints{
+				"us-gov-east-1": endpoint{},
+				"us-gov-west-1": endpoint{},
+			},
+		},
+		"translate": service{
+			Defaults: endpoint{
+				Protocols: []string{"https"},
+			},
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+				"us-gov-west-1-fips": endpoint{
+					Hostname: "translate-fips.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
+			},
+		},
+		"workspaces": service{
+
+			Endpoints: endpoints{
+				"us-gov-west-1": endpoint{},
+			},
+		},
+	},
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/endpoints/dep_service_ids.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/endpoints/dep_service_ids.go
new file mode 100644
index 00000000..000dd79e
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/endpoints/dep_service_ids.go
@@ -0,0 +1,141 @@
+package endpoints
+
+// Service identifiers
+//
+// Deprecated: Use client package's EndpointID value instead of these
+// ServiceIDs. These IDs are not maintained, and are out of date.
+const (
+	A4bServiceID                          = "a4b"                          // A4b.
+	AcmServiceID                          = "acm"                          // Acm.
+	AcmPcaServiceID                       = "acm-pca"                      // AcmPca.
+	ApiMediatailorServiceID               = "api.mediatailor"              // ApiMediatailor.
+	ApiPricingServiceID                   = "api.pricing"                  // ApiPricing.
+	ApiSagemakerServiceID                 = "api.sagemaker"                // ApiSagemaker.
+	ApigatewayServiceID                   = "apigateway"                   // Apigateway.
+	ApplicationAutoscalingServiceID       = "application-autoscaling"      // ApplicationAutoscaling.
+	Appstream2ServiceID                   = "appstream2"                   // Appstream2.
+	AppsyncServiceID                      = "appsync"                      // Appsync.
+	AthenaServiceID                       = "athena"                       // Athena.
+	AutoscalingServiceID                  = "autoscaling"                  // Autoscaling.
+	AutoscalingPlansServiceID             = "autoscaling-plans"            // AutoscalingPlans.
+	BatchServiceID                        = "batch"                        // Batch.
+	BudgetsServiceID                      = "budgets"                      // Budgets.
+	CeServiceID                           = "ce"                           // Ce.
+	ChimeServiceID                        = "chime"                        // Chime.
+	Cloud9ServiceID                       = "cloud9"                       // Cloud9.
+	ClouddirectoryServiceID               = "clouddirectory"               // Clouddirectory.
+	CloudformationServiceID               = "cloudformation"               // Cloudformation.
+	CloudfrontServiceID                   = "cloudfront"                   // Cloudfront.
+	CloudhsmServiceID                     = "cloudhsm"                     // Cloudhsm.
+	Cloudhsmv2ServiceID                   = "cloudhsmv2"                   // Cloudhsmv2.
+	CloudsearchServiceID                  = "cloudsearch"                  // Cloudsearch.
+	CloudtrailServiceID                   = "cloudtrail"                   // Cloudtrail.
+	CodebuildServiceID                    = "codebuild"                    // Codebuild.
+	CodecommitServiceID                   = "codecommit"                   // Codecommit.
+	CodedeployServiceID                   = "codedeploy"                   // Codedeploy.
+	CodepipelineServiceID                 = "codepipeline"                 // Codepipeline.
+	CodestarServiceID                     = "codestar"                     // Codestar.
+	CognitoIdentityServiceID              = "cognito-identity"             // CognitoIdentity.
+	CognitoIdpServiceID                   = "cognito-idp"                  // CognitoIdp.
+	CognitoSyncServiceID                  = "cognito-sync"                 // CognitoSync.
+	ComprehendServiceID                   = "comprehend"                   // Comprehend.
+	ConfigServiceID                       = "config"                       // Config.
+	CurServiceID                          = "cur"                          // Cur.
+	DatapipelineServiceID                 = "datapipeline"                 // Datapipeline.
+	DaxServiceID                          = "dax"                          // Dax.
+	DevicefarmServiceID                   = "devicefarm"                   // Devicefarm.
+	DirectconnectServiceID                = "directconnect"                // Directconnect.
+	DiscoveryServiceID                    = "discovery"                    // Discovery.
+	DmsServiceID                          = "dms"                          // Dms.
+	DsServiceID                           = "ds"                           // Ds.
+	DynamodbServiceID                     = "dynamodb"                     // Dynamodb.
+	Ec2ServiceID                          = "ec2"                          // Ec2.
+	Ec2metadataServiceID                  = "ec2metadata"                  // Ec2metadata.
+	EcrServiceID                          = "ecr"                          // Ecr.
+	EcsServiceID                          = "ecs"                          // Ecs.
+	ElasticacheServiceID                  = "elasticache"                  // Elasticache.
+	ElasticbeanstalkServiceID             = "elasticbeanstalk"             // Elasticbeanstalk.
+	ElasticfilesystemServiceID            = "elasticfilesystem"            // Elasticfilesystem.
+	ElasticloadbalancingServiceID         = "elasticloadbalancing"         // Elasticloadbalancing.
+	ElasticmapreduceServiceID             = "elasticmapreduce"             // Elasticmapreduce.
+	ElastictranscoderServiceID            = "elastictranscoder"            // Elastictranscoder.
+	EmailServiceID                        = "email"                        // Email.
+	EntitlementMarketplaceServiceID       = "entitlement.marketplace"      // EntitlementMarketplace.
+	EsServiceID                           = "es"                           // Es.
+	EventsServiceID                       = "events"                       // Events.
+	FirehoseServiceID                     = "firehose"                     // Firehose.
+	FmsServiceID                          = "fms"                          // Fms.
+	GameliftServiceID                     = "gamelift"                     // Gamelift.
+	GlacierServiceID                      = "glacier"                      // Glacier.
+	GlueServiceID                         = "glue"                         // Glue.
+	GreengrassServiceID                   = "greengrass"                   // Greengrass.
+	GuarddutyServiceID                    = "guardduty"                    // Guardduty.
+	HealthServiceID                       = "health"                       // Health.
+	IamServiceID                          = "iam"                          // Iam.
+	ImportexportServiceID                 = "importexport"                 // Importexport.
+	InspectorServiceID                    = "inspector"                    // Inspector.
+	IotServiceID                          = "iot"                          // Iot.
+	IotanalyticsServiceID                 = "iotanalytics"                 // Iotanalytics.
+	KinesisServiceID                      = "kinesis"                      // Kinesis.
+	KinesisanalyticsServiceID             = "kinesisanalytics"             // Kinesisanalytics.
+	KinesisvideoServiceID                 = "kinesisvideo"                 // Kinesisvideo.
+	KmsServiceID                          = "kms"                          // Kms.
+	LambdaServiceID                       = "lambda"                       // Lambda.
+	LightsailServiceID                    = "lightsail"                    // Lightsail.
+	LogsServiceID                         = "logs"                         // Logs.
+	MachinelearningServiceID              = "machinelearning"              // Machinelearning.
+	MarketplacecommerceanalyticsServiceID = "marketplacecommerceanalytics" // Marketplacecommerceanalytics.
+	MediaconvertServiceID                 = "mediaconvert"                 // Mediaconvert.
+	MedialiveServiceID                    = "medialive"                    // Medialive.
+	MediapackageServiceID                 = "mediapackage"                 // Mediapackage.
+	MediastoreServiceID                   = "mediastore"                   // Mediastore.
+	MeteringMarketplaceServiceID          = "metering.marketplace"         // MeteringMarketplace.
+	MghServiceID                          = "mgh"                          // Mgh.
+	MobileanalyticsServiceID              = "mobileanalytics"              // Mobileanalytics.
+	ModelsLexServiceID                    = "models.lex"                   // ModelsLex.
+	MonitoringServiceID                   = "monitoring"                   // Monitoring.
+	MturkRequesterServiceID               = "mturk-requester"              // MturkRequester.
+	NeptuneServiceID                      = "neptune"                      // Neptune.
+	OpsworksServiceID                     = "opsworks"                     // Opsworks.
+	OpsworksCmServiceID                   = "opsworks-cm"                  // OpsworksCm.
+	OrganizationsServiceID                = "organizations"                // Organizations.
+	PinpointServiceID                     = "pinpoint"                     // Pinpoint.
+	PollyServiceID                        = "polly"                        // Polly.
+	RdsServiceID                          = "rds"                          // Rds.
+	RedshiftServiceID                     = "redshift"                     // Redshift.
+	RekognitionServiceID                  = "rekognition"                  // Rekognition.
+	ResourceGroupsServiceID               = "resource-groups"              // ResourceGroups.
+	Route53ServiceID                      = "route53"                      // Route53.
+	Route53domainsServiceID               = "route53domains"               // Route53domains.
+	RuntimeLexServiceID                   = "runtime.lex"                  // RuntimeLex.
+	RuntimeSagemakerServiceID             = "runtime.sagemaker"            // RuntimeSagemaker.
+	S3ServiceID                           = "s3"                           // S3.
+	S3ControlServiceID                    = "s3-control"                   // S3Control.
+	SagemakerServiceID                    = "api.sagemaker"                // Sagemaker.
+	SdbServiceID                          = "sdb"                          // Sdb.
+	SecretsmanagerServiceID               = "secretsmanager"               // Secretsmanager.
+	ServerlessrepoServiceID               = "serverlessrepo"               // Serverlessrepo.
+	ServicecatalogServiceID               = "servicecatalog"               // Servicecatalog.
+	ServicediscoveryServiceID             = "servicediscovery"             // Servicediscovery.
+	ShieldServiceID                       = "shield"                       // Shield.
+	SmsServiceID                          = "sms"                          // Sms.
+	SnowballServiceID                     = "snowball"                     // Snowball.
+	SnsServiceID                          = "sns"                          // Sns.
+	SqsServiceID                          = "sqs"                          // Sqs.
+	SsmServiceID                          = "ssm"                          // Ssm.
+	StatesServiceID                       = "states"                       // States.
+	StoragegatewayServiceID               = "storagegateway"               // Storagegateway.
+	StreamsDynamodbServiceID              = "streams.dynamodb"             // StreamsDynamodb.
+	StsServiceID                          = "sts"                          // Sts.
+	SupportServiceID                      = "support"                      // Support.
+	SwfServiceID                          = "swf"                          // Swf.
+	TaggingServiceID                      = "tagging"                      // Tagging.
+	TransferServiceID                     = "transfer"                     // Transfer.
+	TranslateServiceID                    = "translate"                    // Translate.
+	WafServiceID                          = "waf"                          // Waf.
+	WafRegionalServiceID                  = "waf-regional"                 // WafRegional.
+	WorkdocsServiceID                     = "workdocs"                     // Workdocs.
+	WorkmailServiceID                     = "workmail"                     // Workmail.
+	WorkspacesServiceID                   = "workspaces"                   // Workspaces.
+	XrayServiceID                         = "xray"                         // Xray.
+)
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/endpoints/doc.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/endpoints/doc.go
new file mode 100644
index 00000000..84316b92
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/endpoints/doc.go
@@ -0,0 +1,66 @@
+// Package endpoints provides the types and functionality for defining regions
+// and endpoints, as well as querying those definitions.
+//
+// The SDK's Regions and Endpoints metadata is code generated into the endpoints
+// package, and is accessible via the DefaultResolver function. This function
+// returns a endpoint Resolver will search the metadata and build an associated
+// endpoint if one is found. The default resolver will search all partitions
+// known by the SDK. e.g AWS Standard (aws), AWS China (aws-cn), and
+// AWS GovCloud (US) (aws-us-gov).
+// .
+//
+// Enumerating Regions and Endpoint Metadata
+//
+// Casting the Resolver returned by DefaultResolver to a EnumPartitions interface
+// will allow you to get access to the list of underlying Partitions with the
+// Partitions method. This is helpful if you want to limit the SDK's endpoint
+// resolving to a single partition, or enumerate regions, services, and endpoints
+// in the partition.
+//
+//     resolver := endpoints.DefaultResolver()
+//     partitions := resolver.(endpoints.EnumPartitions).Partitions()
+//
+//     for _, p := range partitions {
+//         fmt.Println("Regions for", p.ID())
+//         for id, _ := range p.Regions() {
+//             fmt.Println("*", id)
+//         }
+//
+//         fmt.Println("Services for", p.ID())
+//         for id, _ := range p.Services() {
+//             fmt.Println("*", id)
+//         }
+//     }
+//
+// Using Custom Endpoints
+//
+// The endpoints package also gives you the ability to use your own logic how
+// endpoints are resolved. This is a great way to define a custom endpoint
+// for select services, without passing that logic down through your code.
+//
+// If a type implements the Resolver interface it can be used to resolve
+// endpoints. To use this with the SDK's Session and Config set the value
+// of the type to the EndpointsResolver field of aws.Config when initializing
+// the session, or service client.
+//
+// In addition the ResolverFunc is a wrapper for a func matching the signature
+// of Resolver.EndpointFor, converting it to a type that satisfies the
+// Resolver interface.
+//
+//
+//     myCustomResolver := func(service, region string, optFns ...func(*endpoints.Options)) (endpoints.ResolvedEndpoint, error) {
+//         if service == endpoints.S3ServiceID {
+//             return endpoints.ResolvedEndpoint{
+//                 URL:           "s3.custom.endpoint.com",
+//                 SigningRegion: "custom-signing-region",
+//             }, nil
+//         }
+//
+//         return endpoints.DefaultResolver().EndpointFor(service, region, optFns...)
+//     }
+//
+//     sess := session.Must(session.NewSession(&aws.Config{
+//         Region:           aws.String("us-west-2"),
+//         EndpointResolver: endpoints.ResolverFunc(myCustomResolver),
+//     }))
+package endpoints
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/endpoints/endpoints.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/endpoints/endpoints.go
new file mode 100644
index 00000000..f82babf6
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/endpoints/endpoints.go
@@ -0,0 +1,449 @@
+package endpoints
+
+import (
+	"fmt"
+	"regexp"
+
+	"github.com/aws/aws-sdk-go/aws/awserr"
+)
+
+// Options provide the configuration needed to direct how the
+// endpoints will be resolved.
+type Options struct {
+	// DisableSSL forces the endpoint to be resolved as HTTP.
+	// instead of HTTPS if the service supports it.
+	DisableSSL bool
+
+	// Sets the resolver to resolve the endpoint as a dualstack endpoint
+	// for the service. If dualstack support for a service is not known and
+	// StrictMatching is not enabled a dualstack endpoint for the service will
+	// be returned. This endpoint may not be valid. If StrictMatching is
+	// enabled only services that are known to support dualstack will return
+	// dualstack endpoints.
+	UseDualStack bool
+
+	// Enables strict matching of services and regions resolved endpoints.
+	// If the partition doesn't enumerate the exact service and region an
+	// error will be returned. This option will prevent returning endpoints
+	// that look valid, but may not resolve to any real endpoint.
+	StrictMatching bool
+
+	// Enables resolving a service endpoint based on the region provided if the
+	// service does not exist. The service endpoint ID will be used as the service
+	// domain name prefix. By default the endpoint resolver requires the service
+	// to be known when resolving endpoints.
+	//
+	// If resolving an endpoint on the partition list the provided region will
+	// be used to determine which partition's domain name pattern to the service
+	// endpoint ID with. If both the service and region are unknown and resolving
+	// the endpoint on partition list an UnknownEndpointError error will be returned.
+	//
+	// If resolving and endpoint on a partition specific resolver that partition's
+	// domain name pattern will be used with the service endpoint ID. If both
+	// region and service do not exist when resolving an endpoint on a specific
+	// partition the partition's domain pattern will be used to combine the
+	// endpoint and region together.
+	//
+	// This option is ignored if StrictMatching is enabled.
+	ResolveUnknownService bool
+}
+
+// Set combines all of the option functions together.
+func (o *Options) Set(optFns ...func(*Options)) {
+	for _, fn := range optFns {
+		fn(o)
+	}
+}
+
+// DisableSSLOption sets the DisableSSL options. Can be used as a functional
+// option when resolving endpoints.
+func DisableSSLOption(o *Options) {
+	o.DisableSSL = true
+}
+
+// UseDualStackOption sets the UseDualStack option. Can be used as a functional
+// option when resolving endpoints.
+func UseDualStackOption(o *Options) {
+	o.UseDualStack = true
+}
+
+// StrictMatchingOption sets the StrictMatching option. Can be used as a functional
+// option when resolving endpoints.
+func StrictMatchingOption(o *Options) {
+	o.StrictMatching = true
+}
+
+// ResolveUnknownServiceOption sets the ResolveUnknownService option. Can be used
+// as a functional option when resolving endpoints.
+func ResolveUnknownServiceOption(o *Options) {
+	o.ResolveUnknownService = true
+}
+
+// A Resolver provides the interface for functionality to resolve endpoints.
+// The build in Partition and DefaultResolver return value satisfy this interface.
+type Resolver interface {
+	EndpointFor(service, region string, opts ...func(*Options)) (ResolvedEndpoint, error)
+}
+
+// ResolverFunc is a helper utility that wraps a function so it satisfies the
+// Resolver interface. This is useful when you want to add additional endpoint
+// resolving logic, or stub out specific endpoints with custom values.
+type ResolverFunc func(service, region string, opts ...func(*Options)) (ResolvedEndpoint, error)
+
+// EndpointFor wraps the ResolverFunc function to satisfy the Resolver interface.
+func (fn ResolverFunc) EndpointFor(service, region string, opts ...func(*Options)) (ResolvedEndpoint, error) {
+	return fn(service, region, opts...)
+}
+
+var schemeRE = regexp.MustCompile("^([^:]+)://")
+
+// AddScheme adds the HTTP or HTTPS schemes to a endpoint URL if there is no
+// scheme. If disableSSL is true HTTP will set HTTP instead of the default HTTPS.
+//
+// If disableSSL is set, it will only set the URL's scheme if the URL does not
+// contain a scheme.
+func AddScheme(endpoint string, disableSSL bool) string {
+	if !schemeRE.MatchString(endpoint) {
+		scheme := "https"
+		if disableSSL {
+			scheme = "http"
+		}
+		endpoint = fmt.Sprintf("%s://%s", scheme, endpoint)
+	}
+
+	return endpoint
+}
+
+// EnumPartitions a provides a way to retrieve the underlying partitions that
+// make up the SDK's default Resolver, or any resolver decoded from a model
+// file.
+//
+// Use this interface with DefaultResolver and DecodeModels to get the list of
+// Partitions.
+type EnumPartitions interface {
+	Partitions() []Partition
+}
+
+// RegionsForService returns a map of regions for the partition and service.
+// If either the partition or service does not exist false will be returned
+// as the second parameter.
+//
+// This example shows how  to get the regions for DynamoDB in the AWS partition.
+//    rs, exists := endpoints.RegionsForService(endpoints.DefaultPartitions(), endpoints.AwsPartitionID, endpoints.DynamodbServiceID)
+//
+// This is equivalent to using the partition directly.
+//    rs := endpoints.AwsPartition().Services()[endpoints.DynamodbServiceID].Regions()
+func RegionsForService(ps []Partition, partitionID, serviceID string) (map[string]Region, bool) {
+	for _, p := range ps {
+		if p.ID() != partitionID {
+			continue
+		}
+		if _, ok := p.p.Services[serviceID]; !ok {
+			break
+		}
+
+		s := Service{
+			id: serviceID,
+			p:  p.p,
+		}
+		return s.Regions(), true
+	}
+
+	return map[string]Region{}, false
+}
+
+// PartitionForRegion returns the first partition which includes the region
+// passed in. This includes both known regions and regions which match
+// a pattern supported by the partition which may include regions that are
+// not explicitly known by the partition. Use the Regions method of the
+// returned Partition if explicit support is needed.
+func PartitionForRegion(ps []Partition, regionID string) (Partition, bool) {
+	for _, p := range ps {
+		if _, ok := p.p.Regions[regionID]; ok || p.p.RegionRegex.MatchString(regionID) {
+			return p, true
+		}
+	}
+
+	return Partition{}, false
+}
+
+// A Partition provides the ability to enumerate the partition's regions
+// and services.
+type Partition struct {
+	id string
+	p  *partition
+}
+
+// ID returns the identifier of the partition.
+func (p Partition) ID() string { return p.id }
+
+// EndpointFor attempts to resolve the endpoint based on service and region.
+// See Options for information on configuring how the endpoint is resolved.
+//
+// If the service cannot be found in the metadata the UnknownServiceError
+// error will be returned. This validation will occur regardless if
+// StrictMatching is enabled. To enable resolving unknown services set the
+// "ResolveUnknownService" option to true. When StrictMatching is disabled
+// this option allows the partition resolver to resolve a endpoint based on
+// the service endpoint ID provided.
+//
+// When resolving endpoints you can choose to enable StrictMatching. This will
+// require the provided service and region to be known by the partition.
+// If the endpoint cannot be strictly resolved an error will be returned. This
+// mode is useful to ensure the endpoint resolved is valid. Without
+// StrictMatching enabled the endpoint returned my look valid but may not work.
+// StrictMatching requires the SDK to be updated if you want to take advantage
+// of new regions and services expansions.
+//
+// Errors that can be returned.
+//   * UnknownServiceError
+//   * UnknownEndpointError
+func (p Partition) EndpointFor(service, region string, opts ...func(*Options)) (ResolvedEndpoint, error) {
+	return p.p.EndpointFor(service, region, opts...)
+}
+
+// Regions returns a map of Regions indexed by their ID. This is useful for
+// enumerating over the regions in a partition.
+func (p Partition) Regions() map[string]Region {
+	rs := map[string]Region{}
+	for id, r := range p.p.Regions {
+		rs[id] = Region{
+			id:   id,
+			desc: r.Description,
+			p:    p.p,
+		}
+	}
+
+	return rs
+}
+
+// Services returns a map of Service indexed by their ID. This is useful for
+// enumerating over the services in a partition.
+func (p Partition) Services() map[string]Service {
+	ss := map[string]Service{}
+	for id := range p.p.Services {
+		ss[id] = Service{
+			id: id,
+			p:  p.p,
+		}
+	}
+
+	return ss
+}
+
+// A Region provides information about a region, and ability to resolve an
+// endpoint from the context of a region, given a service.
+type Region struct {
+	id, desc string
+	p        *partition
+}
+
+// ID returns the region's identifier.
+func (r Region) ID() string { return r.id }
+
+// Description returns the region's description. The region description
+// is free text, it can be empty, and it may change between SDK releases.
+func (r Region) Description() string { return r.desc }
+
+// ResolveEndpoint resolves an endpoint from the context of the region given
+// a service. See Partition.EndpointFor for usage and errors that can be returned.
+func (r Region) ResolveEndpoint(service string, opts ...func(*Options)) (ResolvedEndpoint, error) {
+	return r.p.EndpointFor(service, r.id, opts...)
+}
+
+// Services returns a list of all services that are known to be in this region.
+func (r Region) Services() map[string]Service {
+	ss := map[string]Service{}
+	for id, s := range r.p.Services {
+		if _, ok := s.Endpoints[r.id]; ok {
+			ss[id] = Service{
+				id: id,
+				p:  r.p,
+			}
+		}
+	}
+
+	return ss
+}
+
+// A Service provides information about a service, and ability to resolve an
+// endpoint from the context of a service, given a region.
+type Service struct {
+	id string
+	p  *partition
+}
+
+// ID returns the identifier for the service.
+func (s Service) ID() string { return s.id }
+
+// ResolveEndpoint resolves an endpoint from the context of a service given
+// a region. See Partition.EndpointFor for usage and errors that can be returned.
+func (s Service) ResolveEndpoint(region string, opts ...func(*Options)) (ResolvedEndpoint, error) {
+	return s.p.EndpointFor(s.id, region, opts...)
+}
+
+// Regions returns a map of Regions that the service is present in.
+//
+// A region is the AWS region the service exists in. Whereas a Endpoint is
+// an URL that can be resolved to a instance of a service.
+func (s Service) Regions() map[string]Region {
+	rs := map[string]Region{}
+	for id := range s.p.Services[s.id].Endpoints {
+		if r, ok := s.p.Regions[id]; ok {
+			rs[id] = Region{
+				id:   id,
+				desc: r.Description,
+				p:    s.p,
+			}
+		}
+	}
+
+	return rs
+}
+
+// Endpoints returns a map of Endpoints indexed by their ID for all known
+// endpoints for a service.
+//
+// A region is the AWS region the service exists in. Whereas a Endpoint is
+// an URL that can be resolved to a instance of a service.
+func (s Service) Endpoints() map[string]Endpoint {
+	es := map[string]Endpoint{}
+	for id := range s.p.Services[s.id].Endpoints {
+		es[id] = Endpoint{
+			id:        id,
+			serviceID: s.id,
+			p:         s.p,
+		}
+	}
+
+	return es
+}
+
+// A Endpoint provides information about endpoints, and provides the ability
+// to resolve that endpoint for the service, and the region the endpoint
+// represents.
+type Endpoint struct {
+	id        string
+	serviceID string
+	p         *partition
+}
+
+// ID returns the identifier for an endpoint.
+func (e Endpoint) ID() string { return e.id }
+
+// ServiceID returns the identifier the endpoint belongs to.
+func (e Endpoint) ServiceID() string { return e.serviceID }
+
+// ResolveEndpoint resolves an endpoint from the context of a service and
+// region the endpoint represents. See Partition.EndpointFor for usage and
+// errors that can be returned.
+func (e Endpoint) ResolveEndpoint(opts ...func(*Options)) (ResolvedEndpoint, error) {
+	return e.p.EndpointFor(e.serviceID, e.id, opts...)
+}
+
+// A ResolvedEndpoint is an endpoint that has been resolved based on a partition
+// service, and region.
+type ResolvedEndpoint struct {
+	// The endpoint URL
+	URL string
+
+	// The region that should be used for signing requests.
+	SigningRegion string
+
+	// The service name that should be used for signing requests.
+	SigningName string
+
+	// States that the signing name for this endpoint was derived from metadata
+	// passed in, but was not explicitly modeled.
+	SigningNameDerived bool
+
+	// The signing method that should be used for signing requests.
+	SigningMethod string
+}
+
+// So that the Error interface type can be included as an anonymous field
+// in the requestError struct and not conflict with the error.Error() method.
+type awsError awserr.Error
+
+// A EndpointNotFoundError is returned when in StrictMatching mode, and the
+// endpoint for the service and region cannot be found in any of the partitions.
+type EndpointNotFoundError struct {
+	awsError
+	Partition string
+	Service   string
+	Region    string
+}
+
+// A UnknownServiceError is returned when the service does not resolve to an
+// endpoint. Includes a list of all known services for the partition. Returned
+// when a partition does not support the service.
+type UnknownServiceError struct {
+	awsError
+	Partition string
+	Service   string
+	Known     []string
+}
+
+// NewUnknownServiceError builds and returns UnknownServiceError.
+func NewUnknownServiceError(p, s string, known []string) UnknownServiceError {
+	return UnknownServiceError{
+		awsError: awserr.New("UnknownServiceError",
+			"could not resolve endpoint for unknown service", nil),
+		Partition: p,
+		Service:   s,
+		Known:     known,
+	}
+}
+
+// String returns the string representation of the error.
+func (e UnknownServiceError) Error() string {
+	extra := fmt.Sprintf("partition: %q, service: %q",
+		e.Partition, e.Service)
+	if len(e.Known) > 0 {
+		extra += fmt.Sprintf(", known: %v", e.Known)
+	}
+	return awserr.SprintError(e.Code(), e.Message(), extra, e.OrigErr())
+}
+
+// String returns the string representation of the error.
+func (e UnknownServiceError) String() string {
+	return e.Error()
+}
+
+// A UnknownEndpointError is returned when in StrictMatching mode and the
+// service is valid, but the region does not resolve to an endpoint. Includes
+// a list of all known endpoints for the service.
+type UnknownEndpointError struct {
+	awsError
+	Partition string
+	Service   string
+	Region    string
+	Known     []string
+}
+
+// NewUnknownEndpointError builds and returns UnknownEndpointError.
+func NewUnknownEndpointError(p, s, r string, known []string) UnknownEndpointError {
+	return UnknownEndpointError{
+		awsError: awserr.New("UnknownEndpointError",
+			"could not resolve endpoint", nil),
+		Partition: p,
+		Service:   s,
+		Region:    r,
+		Known:     known,
+	}
+}
+
+// String returns the string representation of the error.
+func (e UnknownEndpointError) Error() string {
+	extra := fmt.Sprintf("partition: %q, service: %q, region: %q",
+		e.Partition, e.Service, e.Region)
+	if len(e.Known) > 0 {
+		extra += fmt.Sprintf(", known: %v", e.Known)
+	}
+	return awserr.SprintError(e.Code(), e.Message(), extra, e.OrigErr())
+}
+
+// String returns the string representation of the error.
+func (e UnknownEndpointError) String() string {
+	return e.Error()
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/endpoints/v3model.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/endpoints/v3model.go
new file mode 100644
index 00000000..ff6f76db
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/endpoints/v3model.go
@@ -0,0 +1,307 @@
+package endpoints
+
+import (
+	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+type partitions []partition
+
+func (ps partitions) EndpointFor(service, region string, opts ...func(*Options)) (ResolvedEndpoint, error) {
+	var opt Options
+	opt.Set(opts...)
+
+	for i := 0; i < len(ps); i++ {
+		if !ps[i].canResolveEndpoint(service, region, opt.StrictMatching) {
+			continue
+		}
+
+		return ps[i].EndpointFor(service, region, opts...)
+	}
+
+	// If loose matching fallback to first partition format to use
+	// when resolving the endpoint.
+	if !opt.StrictMatching && len(ps) > 0 {
+		return ps[0].EndpointFor(service, region, opts...)
+	}
+
+	return ResolvedEndpoint{}, NewUnknownEndpointError("all partitions", service, region, []string{})
+}
+
+// Partitions satisfies the EnumPartitions interface and returns a list
+// of Partitions representing each partition represented in the SDK's
+// endpoints model.
+func (ps partitions) Partitions() []Partition {
+	parts := make([]Partition, 0, len(ps))
+	for i := 0; i < len(ps); i++ {
+		parts = append(parts, ps[i].Partition())
+	}
+
+	return parts
+}
+
+type partition struct {
+	ID          string      `json:"partition"`
+	Name        string      `json:"partitionName"`
+	DNSSuffix   string      `json:"dnsSuffix"`
+	RegionRegex regionRegex `json:"regionRegex"`
+	Defaults    endpoint    `json:"defaults"`
+	Regions     regions     `json:"regions"`
+	Services    services    `json:"services"`
+}
+
+func (p partition) Partition() Partition {
+	return Partition{
+		id: p.ID,
+		p:  &p,
+	}
+}
+
+func (p partition) canResolveEndpoint(service, region string, strictMatch bool) bool {
+	s, hasService := p.Services[service]
+	_, hasEndpoint := s.Endpoints[region]
+
+	if hasEndpoint && hasService {
+		return true
+	}
+
+	if strictMatch {
+		return false
+	}
+
+	return p.RegionRegex.MatchString(region)
+}
+
+func (p partition) EndpointFor(service, region string, opts ...func(*Options)) (resolved ResolvedEndpoint, err error) {
+	var opt Options
+	opt.Set(opts...)
+
+	s, hasService := p.Services[service]
+	if !(hasService || opt.ResolveUnknownService) {
+		// Only return error if the resolver will not fallback to creating
+		// endpoint based on service endpoint ID passed in.
+		return resolved, NewUnknownServiceError(p.ID, service, serviceList(p.Services))
+	}
+
+	e, hasEndpoint := s.endpointForRegion(region)
+	if !hasEndpoint && opt.StrictMatching {
+		return resolved, NewUnknownEndpointError(p.ID, service, region, endpointList(s.Endpoints))
+	}
+
+	defs := []endpoint{p.Defaults, s.Defaults}
+	return e.resolve(service, region, p.DNSSuffix, defs, opt), nil
+}
+
+func serviceList(ss services) []string {
+	list := make([]string, 0, len(ss))
+	for k := range ss {
+		list = append(list, k)
+	}
+	return list
+}
+func endpointList(es endpoints) []string {
+	list := make([]string, 0, len(es))
+	for k := range es {
+		list = append(list, k)
+	}
+	return list
+}
+
+type regionRegex struct {
+	*regexp.Regexp
+}
+
+func (rr *regionRegex) UnmarshalJSON(b []byte) (err error) {
+	// Strip leading and trailing quotes
+	regex, err := strconv.Unquote(string(b))
+	if err != nil {
+		return fmt.Errorf("unable to strip quotes from regex, %v", err)
+	}
+
+	rr.Regexp, err = regexp.Compile(regex)
+	if err != nil {
+		return fmt.Errorf("unable to unmarshal region regex, %v", err)
+	}
+	return nil
+}
+
+type regions map[string]region
+
+type region struct {
+	Description string `json:"description"`
+}
+
+type services map[string]service
+
+type service struct {
+	PartitionEndpoint string    `json:"partitionEndpoint"`
+	IsRegionalized    boxedBool `json:"isRegionalized,omitempty"`
+	Defaults          endpoint  `json:"defaults"`
+	Endpoints         endpoints `json:"endpoints"`
+}
+
+func (s *service) endpointForRegion(region string) (endpoint, bool) {
+	if s.IsRegionalized == boxedFalse {
+		return s.Endpoints[s.PartitionEndpoint], region == s.PartitionEndpoint
+	}
+
+	if e, ok := s.Endpoints[region]; ok {
+		return e, true
+	}
+
+	// Unable to find any matching endpoint, return
+	// blank that will be used for generic endpoint creation.
+	return endpoint{}, false
+}
+
+type endpoints map[string]endpoint
+
+type endpoint struct {
+	Hostname        string          `json:"hostname"`
+	Protocols       []string        `json:"protocols"`
+	CredentialScope credentialScope `json:"credentialScope"`
+
+	// Custom fields not modeled
+	HasDualStack      boxedBool `json:"-"`
+	DualStackHostname string    `json:"-"`
+
+	// Signature Version not used
+	SignatureVersions []string `json:"signatureVersions"`
+
+	// SSLCommonName not used.
+	SSLCommonName string `json:"sslCommonName"`
+}
+
+const (
+	defaultProtocol = "https"
+	defaultSigner   = "v4"
+)
+
+var (
+	protocolPriority = []string{"https", "http"}
+	signerPriority   = []string{"v4", "v2"}
+)
+
+func getByPriority(s []string, p []string, def string) string {
+	if len(s) == 0 {
+		return def
+	}
+
+	for i := 0; i < len(p); i++ {
+		for j := 0; j < len(s); j++ {
+			if s[j] == p[i] {
+				return s[j]
+			}
+		}
+	}
+
+	return s[0]
+}
+
+func (e endpoint) resolve(service, region, dnsSuffix string, defs []endpoint, opts Options) ResolvedEndpoint {
+	var merged endpoint
+	for _, def := range defs {
+		merged.mergeIn(def)
+	}
+	merged.mergeIn(e)
+	e = merged
+
+	hostname := e.Hostname
+
+	// Offset the hostname for dualstack if enabled
+	if opts.UseDualStack && e.HasDualStack == boxedTrue {
+		hostname = e.DualStackHostname
+	}
+
+	u := strings.Replace(hostname, "{service}", service, 1)
+	u = strings.Replace(u, "{region}", region, 1)
+	u = strings.Replace(u, "{dnsSuffix}", dnsSuffix, 1)
+
+	scheme := getEndpointScheme(e.Protocols, opts.DisableSSL)
+	u = fmt.Sprintf("%s://%s", scheme, u)
+
+	signingRegion := e.CredentialScope.Region
+	if len(signingRegion) == 0 {
+		signingRegion = region
+	}
+
+	signingName := e.CredentialScope.Service
+	var signingNameDerived bool
+	if len(signingName) == 0 {
+		signingName = service
+		signingNameDerived = true
+	}
+
+	return ResolvedEndpoint{
+		URL:                u,
+		SigningRegion:      signingRegion,
+		SigningName:        signingName,
+		SigningNameDerived: signingNameDerived,
+		SigningMethod:      getByPriority(e.SignatureVersions, signerPriority, defaultSigner),
+	}
+}
+
+func getEndpointScheme(protocols []string, disableSSL bool) string {
+	if disableSSL {
+		return "http"
+	}
+
+	return getByPriority(protocols, protocolPriority, defaultProtocol)
+}
+
+func (e *endpoint) mergeIn(other endpoint) {
+	if len(other.Hostname) > 0 {
+		e.Hostname = other.Hostname
+	}
+	if len(other.Protocols) > 0 {
+		e.Protocols = other.Protocols
+	}
+	if len(other.SignatureVersions) > 0 {
+		e.SignatureVersions = other.SignatureVersions
+	}
+	if len(other.CredentialScope.Region) > 0 {
+		e.CredentialScope.Region = other.CredentialScope.Region
+	}
+	if len(other.CredentialScope.Service) > 0 {
+		e.CredentialScope.Service = other.CredentialScope.Service
+	}
+	if len(other.SSLCommonName) > 0 {
+		e.SSLCommonName = other.SSLCommonName
+	}
+	if other.HasDualStack != boxedBoolUnset {
+		e.HasDualStack = other.HasDualStack
+	}
+	if len(other.DualStackHostname) > 0 {
+		e.DualStackHostname = other.DualStackHostname
+	}
+}
+
+type credentialScope struct {
+	Region  string `json:"region"`
+	Service string `json:"service"`
+}
+
+type boxedBool int
+
+func (b *boxedBool) UnmarshalJSON(buf []byte) error {
+	v, err := strconv.ParseBool(string(buf))
+	if err != nil {
+		return err
+	}
+
+	if v {
+		*b = boxedTrue
+	} else {
+		*b = boxedFalse
+	}
+
+	return nil
+}
+
+const (
+	boxedBoolUnset boxedBool = iota
+	boxedFalse
+	boxedTrue
+)
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/endpoints/v3model_codegen.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/endpoints/v3model_codegen.go
new file mode 100644
index 00000000..0fdfcc56
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/endpoints/v3model_codegen.go
@@ -0,0 +1,351 @@
+// +build codegen
+
+package endpoints
+
+import (
+	"fmt"
+	"io"
+	"reflect"
+	"strings"
+	"text/template"
+	"unicode"
+)
+
+// A CodeGenOptions are the options for code generating the endpoints into
+// Go code from the endpoints model definition.
+type CodeGenOptions struct {
+	// Options for how the model will be decoded.
+	DecodeModelOptions DecodeModelOptions
+
+	// Disables code generation of the service endpoint prefix IDs defined in
+	// the model.
+	DisableGenerateServiceIDs bool
+}
+
+// Set combines all of the option functions together
+func (d *CodeGenOptions) Set(optFns ...func(*CodeGenOptions)) {
+	for _, fn := range optFns {
+		fn(d)
+	}
+}
+
+// CodeGenModel given a endpoints model file will decode it and attempt to
+// generate Go code from the model definition. Error will be returned if
+// the code is unable to be generated, or decoded.
+func CodeGenModel(modelFile io.Reader, outFile io.Writer, optFns ...func(*CodeGenOptions)) error {
+	var opts CodeGenOptions
+	opts.Set(optFns...)
+
+	resolver, err := DecodeModel(modelFile, func(d *DecodeModelOptions) {
+		*d = opts.DecodeModelOptions
+	})
+	if err != nil {
+		return err
+	}
+
+	v := struct {
+		Resolver
+		CodeGenOptions
+	}{
+		Resolver:       resolver,
+		CodeGenOptions: opts,
+	}
+
+	tmpl := template.Must(template.New("tmpl").Funcs(funcMap).Parse(v3Tmpl))
+	if err := tmpl.ExecuteTemplate(outFile, "defaults", v); err != nil {
+		return fmt.Errorf("failed to execute template, %v", err)
+	}
+
+	return nil
+}
+
+func toSymbol(v string) string {
+	out := []rune{}
+	for _, c := range strings.Title(v) {
+		if !(unicode.IsNumber(c) || unicode.IsLetter(c)) {
+			continue
+		}
+
+		out = append(out, c)
+	}
+
+	return string(out)
+}
+
+func quoteString(v string) string {
+	return fmt.Sprintf("%q", v)
+}
+
+func regionConstName(p, r string) string {
+	return toSymbol(p) + toSymbol(r)
+}
+
+func partitionGetter(id string) string {
+	return fmt.Sprintf("%sPartition", toSymbol(id))
+}
+
+func partitionVarName(id string) string {
+	return fmt.Sprintf("%sPartition", strings.ToLower(toSymbol(id)))
+}
+
+func listPartitionNames(ps partitions) string {
+	names := []string{}
+	switch len(ps) {
+	case 1:
+		return ps[0].Name
+	case 2:
+		return fmt.Sprintf("%s and %s", ps[0].Name, ps[1].Name)
+	default:
+		for i, p := range ps {
+			if i == len(ps)-1 {
+				names = append(names, "and "+p.Name)
+			} else {
+				names = append(names, p.Name)
+			}
+		}
+		return strings.Join(names, ", ")
+	}
+}
+
+func boxedBoolIfSet(msg string, v boxedBool) string {
+	switch v {
+	case boxedTrue:
+		return fmt.Sprintf(msg, "boxedTrue")
+	case boxedFalse:
+		return fmt.Sprintf(msg, "boxedFalse")
+	default:
+		return ""
+	}
+}
+
+func stringIfSet(msg, v string) string {
+	if len(v) == 0 {
+		return ""
+	}
+
+	return fmt.Sprintf(msg, v)
+}
+
+func stringSliceIfSet(msg string, vs []string) string {
+	if len(vs) == 0 {
+		return ""
+	}
+
+	names := []string{}
+	for _, v := range vs {
+		names = append(names, `"`+v+`"`)
+	}
+
+	return fmt.Sprintf(msg, strings.Join(names, ","))
+}
+
+func endpointIsSet(v endpoint) bool {
+	return !reflect.DeepEqual(v, endpoint{})
+}
+
+func serviceSet(ps partitions) map[string]struct{} {
+	set := map[string]struct{}{}
+	for _, p := range ps {
+		for id := range p.Services {
+			set[id] = struct{}{}
+		}
+	}
+
+	return set
+}
+
+var funcMap = template.FuncMap{
+	"ToSymbol":           toSymbol,
+	"QuoteString":        quoteString,
+	"RegionConst":        regionConstName,
+	"PartitionGetter":    partitionGetter,
+	"PartitionVarName":   partitionVarName,
+	"ListPartitionNames": listPartitionNames,
+	"BoxedBoolIfSet":     boxedBoolIfSet,
+	"StringIfSet":        stringIfSet,
+	"StringSliceIfSet":   stringSliceIfSet,
+	"EndpointIsSet":      endpointIsSet,
+	"ServicesSet":        serviceSet,
+}
+
+const v3Tmpl = `
+{{ define "defaults" -}}
+// Code generated by aws/endpoints/v3model_codegen.go. DO NOT EDIT.
+
+package endpoints
+
+import (
+	"regexp"
+)
+
+	{{ template "partition consts" $.Resolver }}
+
+	{{ range $_, $partition := $.Resolver }}
+		{{ template "partition region consts" $partition }}
+	{{ end }}
+
+	{{ if not $.DisableGenerateServiceIDs -}}
+	{{ template "service consts" $.Resolver }}
+	{{- end }}
+	
+	{{ template "endpoint resolvers" $.Resolver }}
+{{- end }}
+
+{{ define "partition consts" }}
+	// Partition identifiers
+	const (
+		{{ range $_, $p := . -}}
+			{{ ToSymbol $p.ID }}PartitionID = {{ QuoteString $p.ID }} // {{ $p.Name }} partition.
+		{{ end -}}
+	)
+{{- end }}
+
+{{ define "partition region consts" }}
+	// {{ .Name }} partition's regions.
+	const (
+		{{ range $id, $region := .Regions -}}
+			{{ ToSymbol $id }}RegionID = {{ QuoteString $id }} // {{ $region.Description }}.
+		{{ end -}}
+	)
+{{- end }}
+
+{{ define "service consts" }}
+	// Service identifiers
+	const (
+		{{ $serviceSet := ServicesSet . -}}
+		{{ range $id, $_ := $serviceSet -}}
+			{{ ToSymbol $id }}ServiceID = {{ QuoteString $id }} // {{ ToSymbol $id }}.
+		{{ end -}}
+	)
+{{- end }}
+
+{{ define "endpoint resolvers" }}
+	// DefaultResolver returns an Endpoint resolver that will be able
+	// to resolve endpoints for: {{ ListPartitionNames . }}.
+	//
+	// Use DefaultPartitions() to get the list of the default partitions.
+	func DefaultResolver() Resolver {
+		return defaultPartitions
+	}
+
+	// DefaultPartitions returns a list of the partitions the SDK is bundled
+	// with. The available partitions are: {{ ListPartitionNames . }}.
+	//
+	//    partitions := endpoints.DefaultPartitions
+	//    for _, p := range partitions {
+	//        // ... inspect partitions
+	//    }
+	func DefaultPartitions() []Partition {
+		return defaultPartitions.Partitions()
+	}
+
+	var defaultPartitions = partitions{
+		{{ range $_, $partition := . -}}
+			{{ PartitionVarName $partition.ID }},
+		{{ end }}
+	}
+	
+	{{ range $_, $partition := . -}}
+		{{ $name := PartitionGetter $partition.ID -}}
+		// {{ $name }} returns the Resolver for {{ $partition.Name }}.
+		func {{ $name }}() Partition {
+			return  {{ PartitionVarName $partition.ID }}.Partition()
+		}
+		var {{ PartitionVarName $partition.ID }} = {{ template "gocode Partition" $partition }}
+	{{ end }}
+{{ end }}
+
+{{ define "default partitions" }}
+	func DefaultPartitions() []Partition {
+		return []partition{
+			{{ range $_, $partition := . -}}
+			// {{ ToSymbol $partition.ID}}Partition(),
+			{{ end }}
+		}
+	}
+{{ end }}
+
+{{ define "gocode Partition" -}}
+partition{
+	{{ StringIfSet "ID: %q,\n" .ID -}}
+	{{ StringIfSet "Name: %q,\n" .Name -}}
+	{{ StringIfSet "DNSSuffix: %q,\n" .DNSSuffix -}}
+	RegionRegex: {{ template "gocode RegionRegex" .RegionRegex }},
+	{{ if EndpointIsSet .Defaults -}}
+		Defaults: {{ template "gocode Endpoint" .Defaults }},
+	{{- end }}
+	Regions:  {{ template "gocode Regions" .Regions }},
+	Services: {{ template "gocode Services" .Services }},
+}
+{{- end }}
+
+{{ define "gocode RegionRegex" -}}
+regionRegex{
+	Regexp: func() *regexp.Regexp{
+		reg, _ := regexp.Compile({{ QuoteString .Regexp.String }})
+		return reg
+	}(),
+}
+{{- end }}
+
+{{ define "gocode Regions" -}}
+regions{
+	{{ range $id, $region := . -}}
+		"{{ $id }}": {{ template "gocode Region" $region }},
+	{{ end -}}
+}
+{{- end }}
+
+{{ define "gocode Region" -}}
+region{
+	{{ StringIfSet "Description: %q,\n" .Description -}}
+}
+{{- end }}
+
+{{ define "gocode Services" -}}
+services{
+	{{ range $id, $service := . -}}
+	"{{ $id }}": {{ template "gocode Service" $service }},
+	{{ end }}
+}
+{{- end }}
+
+{{ define "gocode Service" -}}
+service{
+	{{ StringIfSet "PartitionEndpoint: %q,\n" .PartitionEndpoint -}}
+	{{ BoxedBoolIfSet "IsRegionalized: %s,\n" .IsRegionalized -}}
+	{{ if EndpointIsSet .Defaults -}}
+		Defaults: {{ template "gocode Endpoint" .Defaults -}},
+	{{- end }}
+	{{ if .Endpoints -}}
+		Endpoints: {{ template "gocode Endpoints" .Endpoints }},
+	{{- end }}
+}
+{{- end }}
+
+{{ define "gocode Endpoints" -}}
+endpoints{
+	{{ range $id, $endpoint := . -}}
+	"{{ $id }}": {{ template "gocode Endpoint" $endpoint }},
+	{{ end }}
+}
+{{- end }}
+
+{{ define "gocode Endpoint" -}}
+endpoint{
+	{{ StringIfSet "Hostname: %q,\n" .Hostname -}}
+	{{ StringIfSet "SSLCommonName: %q,\n" .SSLCommonName -}}
+	{{ StringSliceIfSet "Protocols: []string{%s},\n" .Protocols -}}
+	{{ StringSliceIfSet "SignatureVersions: []string{%s},\n" .SignatureVersions -}}
+	{{ if or .CredentialScope.Region .CredentialScope.Service -}}
+	CredentialScope: credentialScope{
+		{{ StringIfSet "Region: %q,\n" .CredentialScope.Region -}}
+		{{ StringIfSet "Service: %q,\n" .CredentialScope.Service -}}
+	},
+	{{- end }}
+	{{ BoxedBoolIfSet "HasDualStack: %s,\n" .HasDualStack -}}
+	{{ StringIfSet "DualStackHostname: %q,\n" .DualStackHostname -}}
+
+}
+{{- end }}
+`
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/errors.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/errors.go
new file mode 100644
index 00000000..fa06f7a8
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/errors.go
@@ -0,0 +1,13 @@
+package aws
+
+import "github.com/aws/aws-sdk-go/aws/awserr"
+
+var (
+	// ErrMissingRegion is an error that is returned if region configuration is
+	// not found.
+	ErrMissingRegion = awserr.New("MissingRegion", "could not find region configuration", nil)
+
+	// ErrMissingEndpoint is an error that is returned if an endpoint cannot be
+	// resolved for a service.
+	ErrMissingEndpoint = awserr.New("MissingEndpoint", "'Endpoint' configuration is required for this service", nil)
+)
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/jsonvalue.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/jsonvalue.go
new file mode 100644
index 00000000..91a6f277
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/jsonvalue.go
@@ -0,0 +1,12 @@
+package aws
+
+// JSONValue is a representation of a grab bag type that will be marshaled
+// into a json string. This type can be used just like any other map.
+//
+//	Example:
+//
+//	values := aws.JSONValue{
+//		"Foo": "Bar",
+//	}
+//	values["Baz"] = "Qux"
+type JSONValue map[string]interface{}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/logger.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/logger.go
new file mode 100644
index 00000000..6ed15b2e
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/logger.go
@@ -0,0 +1,118 @@
+package aws
+
+import (
+	"log"
+	"os"
+)
+
+// A LogLevelType defines the level logging should be performed at. Used to instruct
+// the SDK which statements should be logged.
+type LogLevelType uint
+
+// LogLevel returns the pointer to a LogLevel. Should be used to workaround
+// not being able to take the address of a non-composite literal.
+func LogLevel(l LogLevelType) *LogLevelType {
+	return &l
+}
+
+// Value returns the LogLevel value or the default value LogOff if the LogLevel
+// is nil. Safe to use on nil value LogLevelTypes.
+func (l *LogLevelType) Value() LogLevelType {
+	if l != nil {
+		return *l
+	}
+	return LogOff
+}
+
+// Matches returns true if the v LogLevel is enabled by this LogLevel. Should be
+// used with logging sub levels. Is safe to use on nil value LogLevelTypes. If
+// LogLevel is nil, will default to LogOff comparison.
+func (l *LogLevelType) Matches(v LogLevelType) bool {
+	c := l.Value()
+	return c&v == v
+}
+
+// AtLeast returns true if this LogLevel is at least high enough to satisfies v.
+// Is safe to use on nil value LogLevelTypes. If LogLevel is nil, will default
+// to LogOff comparison.
+func (l *LogLevelType) AtLeast(v LogLevelType) bool {
+	c := l.Value()
+	return c >= v
+}
+
+const (
+	// LogOff states that no logging should be performed by the SDK. This is the
+	// default state of the SDK, and should be use to disable all logging.
+	LogOff LogLevelType = iota * 0x1000
+
+	// LogDebug state that debug output should be logged by the SDK. This should
+	// be used to inspect request made and responses received.
+	LogDebug
+)
+
+// Debug Logging Sub Levels
+const (
+	// LogDebugWithSigning states that the SDK should log request signing and
+	// presigning events. This should be used to log the signing details of
+	// requests for debugging. Will also enable LogDebug.
+	LogDebugWithSigning LogLevelType = LogDebug | (1 << iota)
+
+	// LogDebugWithHTTPBody states the SDK should log HTTP request and response
+	// HTTP bodys in addition to the headers and path. This should be used to
+	// see the body content of requests and responses made while using the SDK
+	// Will also enable LogDebug.
+	LogDebugWithHTTPBody
+
+	// LogDebugWithRequestRetries states the SDK should log when service requests will
+	// be retried. This should be used to log when you want to log when service
+	// requests are being retried. Will also enable LogDebug.
+	LogDebugWithRequestRetries
+
+	// LogDebugWithRequestErrors states the SDK should log when service requests fail
+	// to build, send, validate, or unmarshal.
+	LogDebugWithRequestErrors
+
+	// LogDebugWithEventStreamBody states the SDK should log EventStream
+	// request and response bodys. This should be used to log the EventStream
+	// wire unmarshaled message content of requests and responses made while
+	// using the SDK Will also enable LogDebug.
+	LogDebugWithEventStreamBody
+)
+
+// A Logger is a minimalistic interface for the SDK to log messages to. Should
+// be used to provide custom logging writers for the SDK to use.
+type Logger interface {
+	Log(...interface{})
+}
+
+// A LoggerFunc is a convenience type to convert a function taking a variadic
+// list of arguments and wrap it so the Logger interface can be used.
+//
+// Example:
+//     s3.New(sess, &aws.Config{Logger: aws.LoggerFunc(func(args ...interface{}) {
+//         fmt.Fprintln(os.Stdout, args...)
+//     })})
+type LoggerFunc func(...interface{})
+
+// Log calls the wrapped function with the arguments provided
+func (f LoggerFunc) Log(args ...interface{}) {
+	f(args...)
+}
+
+// NewDefaultLogger returns a Logger which will write log messages to stdout, and
+// use same formatting runes as the stdlib log.Logger
+func NewDefaultLogger() Logger {
+	return &defaultLogger{
+		logger: log.New(os.Stdout, "", log.LstdFlags),
+	}
+}
+
+// A defaultLogger provides a minimalistic logger satisfying the Logger interface.
+type defaultLogger struct {
+	logger *log.Logger
+}
+
+// Log logs the parameters to the stdlib logger. See log.Println.
+func (l defaultLogger) Log(args ...interface{}) {
+	l.logger.Println(args...)
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/connection_reset_error.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/connection_reset_error.go
new file mode 100644
index 00000000..271da432
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/connection_reset_error.go
@@ -0,0 +1,19 @@
+// +build !appengine,!plan9
+
+package request
+
+import (
+	"net"
+	"os"
+	"syscall"
+)
+
+func isErrConnectionReset(err error) bool {
+	if opErr, ok := err.(*net.OpError); ok {
+		if sysErr, ok := opErr.Err.(*os.SyscallError); ok {
+			return sysErr.Err == syscall.ECONNRESET
+		}
+	}
+
+	return false
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/connection_reset_error_other.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/connection_reset_error_other.go
new file mode 100644
index 00000000..daf9eca4
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/connection_reset_error_other.go
@@ -0,0 +1,11 @@
+// +build appengine plan9
+
+package request
+
+import (
+	"strings"
+)
+
+func isErrConnectionReset(err error) bool {
+	return strings.Contains(err.Error(), "connection reset")
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/handlers.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/handlers.go
new file mode 100644
index 00000000..8ef8548a
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/handlers.go
@@ -0,0 +1,277 @@
+package request
+
+import (
+	"fmt"
+	"strings"
+)
+
+// A Handlers provides a collection of request handlers for various
+// stages of handling requests.
+type Handlers struct {
+	Validate         HandlerList
+	Build            HandlerList
+	Sign             HandlerList
+	Send             HandlerList
+	ValidateResponse HandlerList
+	Unmarshal        HandlerList
+	UnmarshalStream  HandlerList
+	UnmarshalMeta    HandlerList
+	UnmarshalError   HandlerList
+	Retry            HandlerList
+	AfterRetry       HandlerList
+	CompleteAttempt  HandlerList
+	Complete         HandlerList
+}
+
+// Copy returns of this handler's lists.
+func (h *Handlers) Copy() Handlers {
+	return Handlers{
+		Validate:         h.Validate.copy(),
+		Build:            h.Build.copy(),
+		Sign:             h.Sign.copy(),
+		Send:             h.Send.copy(),
+		ValidateResponse: h.ValidateResponse.copy(),
+		Unmarshal:        h.Unmarshal.copy(),
+		UnmarshalStream:  h.UnmarshalStream.copy(),
+		UnmarshalError:   h.UnmarshalError.copy(),
+		UnmarshalMeta:    h.UnmarshalMeta.copy(),
+		Retry:            h.Retry.copy(),
+		AfterRetry:       h.AfterRetry.copy(),
+		CompleteAttempt:  h.CompleteAttempt.copy(),
+		Complete:         h.Complete.copy(),
+	}
+}
+
+// Clear removes callback functions for all handlers
+func (h *Handlers) Clear() {
+	h.Validate.Clear()
+	h.Build.Clear()
+	h.Send.Clear()
+	h.Sign.Clear()
+	h.Unmarshal.Clear()
+	h.UnmarshalStream.Clear()
+	h.UnmarshalMeta.Clear()
+	h.UnmarshalError.Clear()
+	h.ValidateResponse.Clear()
+	h.Retry.Clear()
+	h.AfterRetry.Clear()
+	h.CompleteAttempt.Clear()
+	h.Complete.Clear()
+}
+
+// A HandlerListRunItem represents an entry in the HandlerList which
+// is being run.
+type HandlerListRunItem struct {
+	Index   int
+	Handler NamedHandler
+	Request *Request
+}
+
+// A HandlerList manages zero or more handlers in a list.
+type HandlerList struct {
+	list []NamedHandler
+
+	// Called after each request handler in the list is called. If set
+	// and the func returns true the HandlerList will continue to iterate
+	// over the request handlers. If false is returned the HandlerList
+	// will stop iterating.
+	//
+	// Should be used if extra logic to be performed between each handler
+	// in the list. This can be used to terminate a list's iteration
+	// based on a condition such as error like, HandlerListStopOnError.
+	// Or for logging like HandlerListLogItem.
+	AfterEachFn func(item HandlerListRunItem) bool
+}
+
+// A NamedHandler is a struct that contains a name and function callback.
+type NamedHandler struct {
+	Name string
+	Fn   func(*Request)
+}
+
+// copy creates a copy of the handler list.
+func (l *HandlerList) copy() HandlerList {
+	n := HandlerList{
+		AfterEachFn: l.AfterEachFn,
+	}
+	if len(l.list) == 0 {
+		return n
+	}
+
+	n.list = append(make([]NamedHandler, 0, len(l.list)), l.list...)
+	return n
+}
+
+// Clear clears the handler list.
+func (l *HandlerList) Clear() {
+	l.list = l.list[0:0]
+}
+
+// Len returns the number of handlers in the list.
+func (l *HandlerList) Len() int {
+	return len(l.list)
+}
+
+// PushBack pushes handler f to the back of the handler list.
+func (l *HandlerList) PushBack(f func(*Request)) {
+	l.PushBackNamed(NamedHandler{"__anonymous", f})
+}
+
+// PushBackNamed pushes named handler f to the back of the handler list.
+func (l *HandlerList) PushBackNamed(n NamedHandler) {
+	if cap(l.list) == 0 {
+		l.list = make([]NamedHandler, 0, 5)
+	}
+	l.list = append(l.list, n)
+}
+
+// PushFront pushes handler f to the front of the handler list.
+func (l *HandlerList) PushFront(f func(*Request)) {
+	l.PushFrontNamed(NamedHandler{"__anonymous", f})
+}
+
+// PushFrontNamed pushes named handler f to the front of the handler list.
+func (l *HandlerList) PushFrontNamed(n NamedHandler) {
+	if cap(l.list) == len(l.list) {
+		// Allocating new list required
+		l.list = append([]NamedHandler{n}, l.list...)
+	} else {
+		// Enough room to prepend into list.
+		l.list = append(l.list, NamedHandler{})
+		copy(l.list[1:], l.list)
+		l.list[0] = n
+	}
+}
+
+// Remove removes a NamedHandler n
+func (l *HandlerList) Remove(n NamedHandler) {
+	l.RemoveByName(n.Name)
+}
+
+// RemoveByName removes a NamedHandler by name.
+func (l *HandlerList) RemoveByName(name string) {
+	for i := 0; i < len(l.list); i++ {
+		m := l.list[i]
+		if m.Name == name {
+			// Shift array preventing creating new arrays
+			copy(l.list[i:], l.list[i+1:])
+			l.list[len(l.list)-1] = NamedHandler{}
+			l.list = l.list[:len(l.list)-1]
+
+			// decrement list so next check to length is correct
+			i--
+		}
+	}
+}
+
+// SwapNamed will swap out any existing handlers with the same name as the
+// passed in NamedHandler returning true if handlers were swapped. False is
+// returned otherwise.
+func (l *HandlerList) SwapNamed(n NamedHandler) (swapped bool) {
+	for i := 0; i < len(l.list); i++ {
+		if l.list[i].Name == n.Name {
+			l.list[i].Fn = n.Fn
+			swapped = true
+		}
+	}
+
+	return swapped
+}
+
+// Swap will swap out all handlers matching the name passed in. The matched
+// handlers will be swapped in. True is returned if the handlers were swapped.
+func (l *HandlerList) Swap(name string, replace NamedHandler) bool {
+	var swapped bool
+
+	for i := 0; i < len(l.list); i++ {
+		if l.list[i].Name == name {
+			l.list[i] = replace
+			swapped = true
+		}
+	}
+
+	return swapped
+}
+
+// SetBackNamed will replace the named handler if it exists in the handler list.
+// If the handler does not exist the handler will be added to the end of the list.
+func (l *HandlerList) SetBackNamed(n NamedHandler) {
+	if !l.SwapNamed(n) {
+		l.PushBackNamed(n)
+	}
+}
+
+// SetFrontNamed will replace the named handler if it exists in the handler list.
+// If the handler does not exist the handler will be added to the beginning of
+// the list.
+func (l *HandlerList) SetFrontNamed(n NamedHandler) {
+	if !l.SwapNamed(n) {
+		l.PushFrontNamed(n)
+	}
+}
+
+// Run executes all handlers in the list with a given request object.
+func (l *HandlerList) Run(r *Request) {
+	for i, h := range l.list {
+		h.Fn(r)
+		item := HandlerListRunItem{
+			Index: i, Handler: h, Request: r,
+		}
+		if l.AfterEachFn != nil && !l.AfterEachFn(item) {
+			return
+		}
+	}
+}
+
+// HandlerListLogItem logs the request handler and the state of the
+// request's Error value. Always returns true to continue iterating
+// request handlers in a HandlerList.
+func HandlerListLogItem(item HandlerListRunItem) bool {
+	if item.Request.Config.Logger == nil {
+		return true
+	}
+	item.Request.Config.Logger.Log("DEBUG: RequestHandler",
+		item.Index, item.Handler.Name, item.Request.Error)
+
+	return true
+}
+
+// HandlerListStopOnError returns false to stop the HandlerList iterating
+// over request handlers if Request.Error is not nil. True otherwise
+// to continue iterating.
+func HandlerListStopOnError(item HandlerListRunItem) bool {
+	return item.Request.Error == nil
+}
+
+// WithAppendUserAgent will add a string to the user agent prefixed with a
+// single white space.
+func WithAppendUserAgent(s string) Option {
+	return func(r *Request) {
+		r.Handlers.Build.PushBack(func(r2 *Request) {
+			AddToUserAgent(r, s)
+		})
+	}
+}
+
+// MakeAddToUserAgentHandler will add the name/version pair to the User-Agent request
+// header. If the extra parameters are provided they will be added as metadata to the
+// name/version pair resulting in the following format.
+// "name/version (extra0; extra1; ...)"
+// The user agent part will be concatenated with this current request's user agent string.
+func MakeAddToUserAgentHandler(name, version string, extra ...string) func(*Request) {
+	ua := fmt.Sprintf("%s/%s", name, version)
+	if len(extra) > 0 {
+		ua += fmt.Sprintf(" (%s)", strings.Join(extra, "; "))
+	}
+	return func(r *Request) {
+		AddToUserAgent(r, ua)
+	}
+}
+
+// MakeAddToUserAgentFreeFormHandler adds the input to the User-Agent request header.
+// The input string will be concatenated with the current request's user agent string.
+func MakeAddToUserAgentFreeFormHandler(s string) func(*Request) {
+	return func(r *Request) {
+		AddToUserAgent(r, s)
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/http_request.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/http_request.go
new file mode 100644
index 00000000..79f79602
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/http_request.go
@@ -0,0 +1,24 @@
+package request
+
+import (
+	"io"
+	"net/http"
+	"net/url"
+)
+
+func copyHTTPRequest(r *http.Request, body io.ReadCloser) *http.Request {
+	req := new(http.Request)
+	*req = *r
+	req.URL = &url.URL{}
+	*req.URL = *r.URL
+	req.Body = body
+
+	req.Header = http.Header{}
+	for k, v := range r.Header {
+		for _, vv := range v {
+			req.Header.Add(k, vv)
+		}
+	}
+
+	return req
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/offset_reader.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/offset_reader.go
new file mode 100644
index 00000000..b0c2ef4f
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/offset_reader.go
@@ -0,0 +1,60 @@
+package request
+
+import (
+	"io"
+	"sync"
+
+	"github.com/aws/aws-sdk-go/internal/sdkio"
+)
+
+// offsetReader is a thread-safe io.ReadCloser to prevent racing
+// with retrying requests
+type offsetReader struct {
+	buf    io.ReadSeeker
+	lock   sync.Mutex
+	closed bool
+}
+
+func newOffsetReader(buf io.ReadSeeker, offset int64) *offsetReader {
+	reader := &offsetReader{}
+	buf.Seek(offset, sdkio.SeekStart)
+
+	reader.buf = buf
+	return reader
+}
+
+// Close will close the instance of the offset reader's access to
+// the underlying io.ReadSeeker.
+func (o *offsetReader) Close() error {
+	o.lock.Lock()
+	defer o.lock.Unlock()
+	o.closed = true
+	return nil
+}
+
+// Read is a thread-safe read of the underlying io.ReadSeeker
+func (o *offsetReader) Read(p []byte) (int, error) {
+	o.lock.Lock()
+	defer o.lock.Unlock()
+
+	if o.closed {
+		return 0, io.EOF
+	}
+
+	return o.buf.Read(p)
+}
+
+// Seek is a thread-safe seeking operation.
+func (o *offsetReader) Seek(offset int64, whence int) (int64, error) {
+	o.lock.Lock()
+	defer o.lock.Unlock()
+
+	return o.buf.Seek(offset, whence)
+}
+
+// CloseAndCopy will return a new offsetReader with a copy of the old buffer
+// and close the old buffer.
+func (o *offsetReader) CloseAndCopy(offset int64) *offsetReader {
+	o.Close()
+	return newOffsetReader(o.buf, offset)
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/request.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/request.go
new file mode 100644
index 00000000..8f2eb3e4
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/request.go
@@ -0,0 +1,673 @@
+package request
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"reflect"
+	"strings"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/client/metadata"
+	"github.com/aws/aws-sdk-go/internal/sdkio"
+)
+
+const (
+	// ErrCodeSerialization is the serialization error code that is received
+	// during protocol unmarshaling.
+	ErrCodeSerialization = "SerializationError"
+
+	// ErrCodeRead is an error that is returned during HTTP reads.
+	ErrCodeRead = "ReadError"
+
+	// ErrCodeResponseTimeout is the connection timeout error that is received
+	// during body reads.
+	ErrCodeResponseTimeout = "ResponseTimeout"
+
+	// ErrCodeInvalidPresignExpire is returned when the expire time provided to
+	// presign is invalid
+	ErrCodeInvalidPresignExpire = "InvalidPresignExpireError"
+
+	// CanceledErrorCode is the error code that will be returned by an
+	// API request that was canceled. Requests given a aws.Context may
+	// return this error when canceled.
+	CanceledErrorCode = "RequestCanceled"
+)
+
+// A Request is the service request to be made.
+type Request struct {
+	Config     aws.Config
+	ClientInfo metadata.ClientInfo
+	Handlers   Handlers
+
+	Retryer
+	AttemptTime            time.Time
+	Time                   time.Time
+	Operation              *Operation
+	HTTPRequest            *http.Request
+	HTTPResponse           *http.Response
+	Body                   io.ReadSeeker
+	BodyStart              int64 // offset from beginning of Body that the request body starts
+	Params                 interface{}
+	Error                  error
+	Data                   interface{}
+	RequestID              string
+	RetryCount             int
+	Retryable              *bool
+	RetryDelay             time.Duration
+	NotHoist               bool
+	SignedHeaderVals       http.Header
+	LastSignedAt           time.Time
+	DisableFollowRedirects bool
+
+	// A value greater than 0 instructs the request to be signed as Presigned URL
+	// You should not set this field directly. Instead use Request's
+	// Presign or PresignRequest methods.
+	ExpireTime time.Duration
+
+	context aws.Context
+
+	built bool
+
+	// Need to persist an intermediate body between the input Body and HTTP
+	// request body because the HTTP Client's transport can maintain a reference
+	// to the HTTP request's body after the client has returned. This value is
+	// safe to use concurrently and wrap the input Body for each HTTP request.
+	safeBody *offsetReader
+}
+
+// An Operation is the service API operation to be made.
+type Operation struct {
+	Name       string
+	HTTPMethod string
+	HTTPPath   string
+	*Paginator
+
+	BeforePresignFn func(r *Request) error
+}
+
+// New returns a new Request pointer for the service API
+// operation and parameters.
+//
+// Params is any value of input parameters to be the request payload.
+// Data is pointer value to an object which the request's response
+// payload will be deserialized to.
+func New(cfg aws.Config, clientInfo metadata.ClientInfo, handlers Handlers,
+	retryer Retryer, operation *Operation, params interface{}, data interface{}) *Request {
+
+	method := operation.HTTPMethod
+	if method == "" {
+		method = "POST"
+	}
+
+	httpReq, _ := http.NewRequest(method, "", nil)
+
+	var err error
+	httpReq.URL, err = url.Parse(clientInfo.Endpoint + operation.HTTPPath)
+	if err != nil {
+		httpReq.URL = &url.URL{}
+		err = awserr.New("InvalidEndpointURL", "invalid endpoint uri", err)
+	}
+
+	SanitizeHostForHeader(httpReq)
+
+	r := &Request{
+		Config:     cfg,
+		ClientInfo: clientInfo,
+		Handlers:   handlers.Copy(),
+
+		Retryer:     retryer,
+		Time:        time.Now(),
+		ExpireTime:  0,
+		Operation:   operation,
+		HTTPRequest: httpReq,
+		Body:        nil,
+		Params:      params,
+		Error:       err,
+		Data:        data,
+	}
+	r.SetBufferBody([]byte{})
+
+	return r
+}
+
+// A Option is a functional option that can augment or modify a request when
+// using a WithContext API operation method.
+type Option func(*Request)
+
+// WithGetResponseHeader builds a request Option which will retrieve a single
+// header value from the HTTP Response. If there are multiple values for the
+// header key use WithGetResponseHeaders instead to access the http.Header
+// map directly. The passed in val pointer must be non-nil.
+//
+// This Option can be used multiple times with a single API operation.
+//
+//    var id2, versionID string
+//    svc.PutObjectWithContext(ctx, params,
+//        request.WithGetResponseHeader("x-amz-id-2", &id2),
+//        request.WithGetResponseHeader("x-amz-version-id", &versionID),
+//    )
+func WithGetResponseHeader(key string, val *string) Option {
+	return func(r *Request) {
+		r.Handlers.Complete.PushBack(func(req *Request) {
+			*val = req.HTTPResponse.Header.Get(key)
+		})
+	}
+}
+
+// WithGetResponseHeaders builds a request Option which will retrieve the
+// headers from the HTTP response and assign them to the passed in headers
+// variable. The passed in headers pointer must be non-nil.
+//
+//    var headers http.Header
+//    svc.PutObjectWithContext(ctx, params, request.WithGetResponseHeaders(&headers))
+func WithGetResponseHeaders(headers *http.Header) Option {
+	return func(r *Request) {
+		r.Handlers.Complete.PushBack(func(req *Request) {
+			*headers = req.HTTPResponse.Header
+		})
+	}
+}
+
+// WithLogLevel is a request option that will set the request to use a specific
+// log level when the request is made.
+//
+//     svc.PutObjectWithContext(ctx, params, request.WithLogLevel(aws.LogDebugWithHTTPBody)
+func WithLogLevel(l aws.LogLevelType) Option {
+	return func(r *Request) {
+		r.Config.LogLevel = aws.LogLevel(l)
+	}
+}
+
+// ApplyOptions will apply each option to the request calling them in the order
+// the were provided.
+func (r *Request) ApplyOptions(opts ...Option) {
+	for _, opt := range opts {
+		opt(r)
+	}
+}
+
+// Context will always returns a non-nil context. If Request does not have a
+// context aws.BackgroundContext will be returned.
+func (r *Request) Context() aws.Context {
+	if r.context != nil {
+		return r.context
+	}
+	return aws.BackgroundContext()
+}
+
+// SetContext adds a Context to the current request that can be used to cancel
+// a in-flight request. The Context value must not be nil, or this method will
+// panic.
+//
+// Unlike http.Request.WithContext, SetContext does not return a copy of the
+// Request. It is not safe to use use a single Request value for multiple
+// requests. A new Request should be created for each API operation request.
+//
+// Go 1.6 and below:
+// The http.Request's Cancel field will be set to the Done() value of
+// the context. This will overwrite the Cancel field's value.
+//
+// Go 1.7 and above:
+// The http.Request.WithContext will be used to set the context on the underlying
+// http.Request. This will create a shallow copy of the http.Request. The SDK
+// may create sub contexts in the future for nested requests such as retries.
+func (r *Request) SetContext(ctx aws.Context) {
+	if ctx == nil {
+		panic("context cannot be nil")
+	}
+	setRequestContext(r, ctx)
+}
+
+// WillRetry returns if the request's can be retried.
+func (r *Request) WillRetry() bool {
+	if !aws.IsReaderSeekable(r.Body) && r.HTTPRequest.Body != NoBody {
+		return false
+	}
+	return r.Error != nil && aws.BoolValue(r.Retryable) && r.RetryCount < r.MaxRetries()
+}
+
+// ParamsFilled returns if the request's parameters have been populated
+// and the parameters are valid. False is returned if no parameters are
+// provided or invalid.
+func (r *Request) ParamsFilled() bool {
+	return r.Params != nil && reflect.ValueOf(r.Params).Elem().IsValid()
+}
+
+// DataFilled returns true if the request's data for response deserialization
+// target has been set and is a valid. False is returned if data is not
+// set, or is invalid.
+func (r *Request) DataFilled() bool {
+	return r.Data != nil && reflect.ValueOf(r.Data).Elem().IsValid()
+}
+
+// SetBufferBody will set the request's body bytes that will be sent to
+// the service API.
+func (r *Request) SetBufferBody(buf []byte) {
+	r.SetReaderBody(bytes.NewReader(buf))
+}
+
+// SetStringBody sets the body of the request to be backed by a string.
+func (r *Request) SetStringBody(s string) {
+	r.SetReaderBody(strings.NewReader(s))
+}
+
+// SetReaderBody will set the request's body reader.
+func (r *Request) SetReaderBody(reader io.ReadSeeker) {
+	r.Body = reader
+	r.BodyStart, _ = reader.Seek(0, sdkio.SeekCurrent) // Get the Bodies current offset.
+	r.ResetBody()
+}
+
+// Presign returns the request's signed URL. Error will be returned
+// if the signing fails. The expire parameter is only used for presigned Amazon
+// S3 API requests. All other AWS services will use a fixed expiration
+// time of 15 minutes.
+//
+// It is invalid to create a presigned URL with a expire duration 0 or less. An
+// error is returned if expire duration is 0 or less.
+func (r *Request) Presign(expire time.Duration) (string, error) {
+	r = r.copy()
+
+	// Presign requires all headers be hoisted. There is no way to retrieve
+	// the signed headers not hoisted without this. Making the presigned URL
+	// useless.
+	r.NotHoist = false
+
+	u, _, err := getPresignedURL(r, expire)
+	return u, err
+}
+
+// PresignRequest behaves just like presign, with the addition of returning a
+// set of headers that were signed. The expire parameter is only used for
+// presigned Amazon S3 API requests. All other AWS services will use a fixed
+// expiration time of 15 minutes.
+//
+// It is invalid to create a presigned URL with a expire duration 0 or less. An
+// error is returned if expire duration is 0 or less.
+//
+// Returns the URL string for the API operation with signature in the query string,
+// and the HTTP headers that were included in the signature. These headers must
+// be included in any HTTP request made with the presigned URL.
+//
+// To prevent hoisting any headers to the query string set NotHoist to true on
+// this Request value prior to calling PresignRequest.
+func (r *Request) PresignRequest(expire time.Duration) (string, http.Header, error) {
+	r = r.copy()
+	return getPresignedURL(r, expire)
+}
+
+// IsPresigned returns true if the request represents a presigned API url.
+func (r *Request) IsPresigned() bool {
+	return r.ExpireTime != 0
+}
+
+func getPresignedURL(r *Request, expire time.Duration) (string, http.Header, error) {
+	if expire <= 0 {
+		return "", nil, awserr.New(
+			ErrCodeInvalidPresignExpire,
+			"presigned URL requires an expire duration greater than 0",
+			nil,
+		)
+	}
+
+	r.ExpireTime = expire
+
+	if r.Operation.BeforePresignFn != nil {
+		if err := r.Operation.BeforePresignFn(r); err != nil {
+			return "", nil, err
+		}
+	}
+
+	if err := r.Sign(); err != nil {
+		return "", nil, err
+	}
+
+	return r.HTTPRequest.URL.String(), r.SignedHeaderVals, nil
+}
+
+func debugLogReqError(r *Request, stage string, retrying bool, err error) {
+	if !r.Config.LogLevel.Matches(aws.LogDebugWithRequestErrors) {
+		return
+	}
+
+	retryStr := "not retrying"
+	if retrying {
+		retryStr = "will retry"
+	}
+
+	r.Config.Logger.Log(fmt.Sprintf("DEBUG: %s %s/%s failed, %s, error %v",
+		stage, r.ClientInfo.ServiceName, r.Operation.Name, retryStr, err))
+}
+
+// Build will build the request's object so it can be signed and sent
+// to the service. Build will also validate all the request's parameters.
+// Any additional build Handlers set on this request will be run
+// in the order they were set.
+//
+// The request will only be built once. Multiple calls to build will have
+// no effect.
+//
+// If any Validate or Build errors occur the build will stop and the error
+// which occurred will be returned.
+func (r *Request) Build() error {
+	if !r.built {
+		r.Handlers.Validate.Run(r)
+		if r.Error != nil {
+			debugLogReqError(r, "Validate Request", false, r.Error)
+			return r.Error
+		}
+		r.Handlers.Build.Run(r)
+		if r.Error != nil {
+			debugLogReqError(r, "Build Request", false, r.Error)
+			return r.Error
+		}
+		r.built = true
+	}
+
+	return r.Error
+}
+
+// Sign will sign the request, returning error if errors are encountered.
+//
+// Sign will build the request prior to signing. All Sign Handlers will
+// be executed in the order they were set.
+func (r *Request) Sign() error {
+	r.Build()
+	if r.Error != nil {
+		debugLogReqError(r, "Build Request", false, r.Error)
+		return r.Error
+	}
+
+	r.Handlers.Sign.Run(r)
+	return r.Error
+}
+
+func (r *Request) getNextRequestBody() (io.ReadCloser, error) {
+	if r.safeBody != nil {
+		r.safeBody.Close()
+	}
+
+	r.safeBody = newOffsetReader(r.Body, r.BodyStart)
+
+	// Go 1.8 tightened and clarified the rules code needs to use when building
+	// requests with the http package. Go 1.8 removed the automatic detection
+	// of if the Request.Body was empty, or actually had bytes in it. The SDK
+	// always sets the Request.Body even if it is empty and should not actually
+	// be sent. This is incorrect.
+	//
+	// Go 1.8 did add a http.NoBody value that the SDK can use to tell the http
+	// client that the request really should be sent without a body. The
+	// Request.Body cannot be set to nil, which is preferable, because the
+	// field is exported and could introduce nil pointer dereferences for users
+	// of the SDK if they used that field.
+	//
+	// Related golang/go#18257
+	l, err := aws.SeekerLen(r.Body)
+	if err != nil {
+		return nil, awserr.New(ErrCodeSerialization, "failed to compute request body size", err)
+	}
+
+	var body io.ReadCloser
+	if l == 0 {
+		body = NoBody
+	} else if l > 0 {
+		body = r.safeBody
+	} else {
+		// Hack to prevent sending bodies for methods where the body
+		// should be ignored by the server. Sending bodies on these
+		// methods without an associated ContentLength will cause the
+		// request to socket timeout because the server does not handle
+		// Transfer-Encoding: chunked bodies for these methods.
+		//
+		// This would only happen if a aws.ReaderSeekerCloser was used with
+		// a io.Reader that was not also an io.Seeker, or did not implement
+		// Len() method.
+		switch r.Operation.HTTPMethod {
+		case "GET", "HEAD", "DELETE":
+			body = NoBody
+		default:
+			body = r.safeBody
+		}
+	}
+
+	return body, nil
+}
+
+// GetBody will return an io.ReadSeeker of the Request's underlying
+// input body with a concurrency safe wrapper.
+func (r *Request) GetBody() io.ReadSeeker {
+	return r.safeBody
+}
+
+// Send will send the request, returning error if errors are encountered.
+//
+// Send will sign the request prior to sending. All Send Handlers will
+// be executed in the order they were set.
+//
+// Canceling a request is non-deterministic. If a request has been canceled,
+// then the transport will choose, randomly, one of the state channels during
+// reads or getting the connection.
+//
+// readLoop() and getConn(req *Request, cm connectMethod)
+// https://github.com/golang/go/blob/master/src/net/http/transport.go
+//
+// Send will not close the request.Request's body.
+func (r *Request) Send() error {
+	defer func() {
+		// Regardless of success or failure of the request trigger the Complete
+		// request handlers.
+		r.Handlers.Complete.Run(r)
+	}()
+
+	if err := r.Error; err != nil {
+		return err
+	}
+
+	for {
+		r.Error = nil
+		r.AttemptTime = time.Now()
+
+		if err := r.Sign(); err != nil {
+			debugLogReqError(r, "Sign Request", false, err)
+			return err
+		}
+
+		if err := r.sendRequest(); err == nil {
+			return nil
+		} else if !shouldRetryCancel(r.Error) {
+			return err
+		} else {
+			r.Handlers.Retry.Run(r)
+			r.Handlers.AfterRetry.Run(r)
+
+			if r.Error != nil || !aws.BoolValue(r.Retryable) {
+				return r.Error
+			}
+
+			r.prepareRetry()
+			continue
+		}
+	}
+}
+
+func (r *Request) prepareRetry() {
+	if r.Config.LogLevel.Matches(aws.LogDebugWithRequestRetries) {
+		r.Config.Logger.Log(fmt.Sprintf("DEBUG: Retrying Request %s/%s, attempt %d",
+			r.ClientInfo.ServiceName, r.Operation.Name, r.RetryCount))
+	}
+
+	// The previous http.Request will have a reference to the r.Body
+	// and the HTTP Client's Transport may still be reading from
+	// the request's body even though the Client's Do returned.
+	r.HTTPRequest = copyHTTPRequest(r.HTTPRequest, nil)
+	r.ResetBody()
+
+	// Closing response body to ensure that no response body is leaked
+	// between retry attempts.
+	if r.HTTPResponse != nil && r.HTTPResponse.Body != nil {
+		r.HTTPResponse.Body.Close()
+	}
+}
+
+func (r *Request) sendRequest() (sendErr error) {
+	defer r.Handlers.CompleteAttempt.Run(r)
+
+	r.Retryable = nil
+	r.Handlers.Send.Run(r)
+	if r.Error != nil {
+		debugLogReqError(r, "Send Request", r.WillRetry(), r.Error)
+		return r.Error
+	}
+
+	r.Handlers.UnmarshalMeta.Run(r)
+	r.Handlers.ValidateResponse.Run(r)
+	if r.Error != nil {
+		r.Handlers.UnmarshalError.Run(r)
+		debugLogReqError(r, "Validate Response", r.WillRetry(), r.Error)
+		return r.Error
+	}
+
+	r.Handlers.Unmarshal.Run(r)
+	if r.Error != nil {
+		debugLogReqError(r, "Unmarshal Response", r.WillRetry(), r.Error)
+		return r.Error
+	}
+
+	return nil
+}
+
+// copy will copy a request which will allow for local manipulation of the
+// request.
+func (r *Request) copy() *Request {
+	req := &Request{}
+	*req = *r
+	req.Handlers = r.Handlers.Copy()
+	op := *r.Operation
+	req.Operation = &op
+	return req
+}
+
+// AddToUserAgent adds the string to the end of the request's current user agent.
+func AddToUserAgent(r *Request, s string) {
+	curUA := r.HTTPRequest.Header.Get("User-Agent")
+	if len(curUA) > 0 {
+		s = curUA + " " + s
+	}
+	r.HTTPRequest.Header.Set("User-Agent", s)
+}
+
+type temporary interface {
+	Temporary() bool
+}
+
+func shouldRetryCancel(err error) bool {
+	switch err := err.(type) {
+	case awserr.Error:
+		if err.Code() == CanceledErrorCode {
+			return false
+		}
+		return shouldRetryCancel(err.OrigErr())
+	case *url.Error:
+		if strings.Contains(err.Error(), "connection refused") {
+			// Refused connections should be retried as the service may not yet
+			// be running on the port. Go TCP dial considers refused
+			// connections as not temporary.
+			return true
+		}
+		// *url.Error only implements Temporary after golang 1.6 but since
+		// url.Error only wraps the error:
+		return shouldRetryCancel(err.Err)
+	case temporary:
+		// If the error is temporary, we want to allow continuation of the
+		// retry process
+		return err.Temporary()
+	case nil:
+		// `awserr.Error.OrigErr()` can be nil, meaning there was an error but
+		// because we don't know the cause, it is marked as retriable. See
+		// TestRequest4xxUnretryable for an example.
+		return true
+	default:
+		switch err.Error() {
+		case "net/http: request canceled",
+			"net/http: request canceled while waiting for connection":
+			// known 1.5 error case when an http request is cancelled
+			return false
+		}
+		// here we don't know the error; so we allow a retry.
+		return true
+	}
+}
+
+// SanitizeHostForHeader removes default port from host and updates request.Host
+func SanitizeHostForHeader(r *http.Request) {
+	host := getHost(r)
+	port := portOnly(host)
+	if port != "" && isDefaultPort(r.URL.Scheme, port) {
+		r.Host = stripPort(host)
+	}
+}
+
+// Returns host from request
+func getHost(r *http.Request) string {
+	if r.Host != "" {
+		return r.Host
+	}
+
+	return r.URL.Host
+}
+
+// Hostname returns u.Host, without any port number.
+//
+// If Host is an IPv6 literal with a port number, Hostname returns the
+// IPv6 literal without the square brackets. IPv6 literals may include
+// a zone identifier.
+//
+// Copied from the Go 1.8 standard library (net/url)
+func stripPort(hostport string) string {
+	colon := strings.IndexByte(hostport, ':')
+	if colon == -1 {
+		return hostport
+	}
+	if i := strings.IndexByte(hostport, ']'); i != -1 {
+		return strings.TrimPrefix(hostport[:i], "[")
+	}
+	return hostport[:colon]
+}
+
+// Port returns the port part of u.Host, without the leading colon.
+// If u.Host doesn't contain a port, Port returns an empty string.
+//
+// Copied from the Go 1.8 standard library (net/url)
+func portOnly(hostport string) string {
+	colon := strings.IndexByte(hostport, ':')
+	if colon == -1 {
+		return ""
+	}
+	if i := strings.Index(hostport, "]:"); i != -1 {
+		return hostport[i+len("]:"):]
+	}
+	if strings.Contains(hostport, "]") {
+		return ""
+	}
+	return hostport[colon+len(":"):]
+}
+
+// Returns true if the specified URI is using the standard port
+// (i.e. port 80 for HTTP URIs or 443 for HTTPS URIs)
+func isDefaultPort(scheme, port string) bool {
+	if port == "" {
+		return true
+	}
+
+	lowerCaseScheme := strings.ToLower(scheme)
+	if (lowerCaseScheme == "http" && port == "80") || (lowerCaseScheme == "https" && port == "443") {
+		return true
+	}
+
+	return false
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/request_1_7.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/request_1_7.go
new file mode 100644
index 00000000..e36e468b
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/request_1_7.go
@@ -0,0 +1,39 @@
+// +build !go1.8
+
+package request
+
+import "io"
+
+// NoBody is an io.ReadCloser with no bytes. Read always returns EOF
+// and Close always returns nil. It can be used in an outgoing client
+// request to explicitly signal that a request has zero bytes.
+// An alternative, however, is to simply set Request.Body to nil.
+//
+// Copy of Go 1.8 NoBody type from net/http/http.go
+type noBody struct{}
+
+func (noBody) Read([]byte) (int, error)         { return 0, io.EOF }
+func (noBody) Close() error                     { return nil }
+func (noBody) WriteTo(io.Writer) (int64, error) { return 0, nil }
+
+// NoBody is an empty reader that will trigger the Go HTTP client to not include
+// and body in the HTTP request.
+var NoBody = noBody{}
+
+// ResetBody rewinds the request body back to its starting position, and
+// sets the HTTP Request body reference. When the body is read prior
+// to being sent in the HTTP request it will need to be rewound.
+//
+// ResetBody will automatically be called by the SDK's build handler, but if
+// the request is being used directly ResetBody must be called before the request
+// is Sent.  SetStringBody, SetBufferBody, and SetReaderBody will automatically
+// call ResetBody.
+func (r *Request) ResetBody() {
+	body, err := r.getNextRequestBody()
+	if err != nil {
+		r.Error = err
+		return
+	}
+
+	r.HTTPRequest.Body = body
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/request_1_8.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/request_1_8.go
new file mode 100644
index 00000000..7c6a8000
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/request_1_8.go
@@ -0,0 +1,33 @@
+// +build go1.8
+
+package request
+
+import (
+	"net/http"
+)
+
+// NoBody is a http.NoBody reader instructing Go HTTP client to not include
+// and body in the HTTP request.
+var NoBody = http.NoBody
+
+// ResetBody rewinds the request body back to its starting position, and
+// sets the HTTP Request body reference. When the body is read prior
+// to being sent in the HTTP request it will need to be rewound.
+//
+// ResetBody will automatically be called by the SDK's build handler, but if
+// the request is being used directly ResetBody must be called before the request
+// is Sent.  SetStringBody, SetBufferBody, and SetReaderBody will automatically
+// call ResetBody.
+//
+// Will also set the Go 1.8's http.Request.GetBody member to allow retrying
+// PUT/POST redirects.
+func (r *Request) ResetBody() {
+	body, err := r.getNextRequestBody()
+	if err != nil {
+		r.Error = err
+		return
+	}
+
+	r.HTTPRequest.Body = body
+	r.HTTPRequest.GetBody = r.getNextRequestBody
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/request_context.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/request_context.go
new file mode 100644
index 00000000..a7365cd1
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/request_context.go
@@ -0,0 +1,14 @@
+// +build go1.7
+
+package request
+
+import "github.com/aws/aws-sdk-go/aws"
+
+// setContext updates the Request to use the passed in context for cancellation.
+// Context will also be used for request retry delay.
+//
+// Creates shallow copy of the http.Request with the WithContext method.
+func setRequestContext(r *Request, ctx aws.Context) {
+	r.context = ctx
+	r.HTTPRequest = r.HTTPRequest.WithContext(ctx)
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/request_context_1_6.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/request_context_1_6.go
new file mode 100644
index 00000000..307fa070
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/request_context_1_6.go
@@ -0,0 +1,14 @@
+// +build !go1.7
+
+package request
+
+import "github.com/aws/aws-sdk-go/aws"
+
+// setContext updates the Request to use the passed in context for cancellation.
+// Context will also be used for request retry delay.
+//
+// Creates shallow copy of the http.Request with the WithContext method.
+func setRequestContext(r *Request, ctx aws.Context) {
+	r.context = ctx
+	r.HTTPRequest.Cancel = ctx.Done()
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/request_pagination.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/request_pagination.go
new file mode 100644
index 00000000..a633ed5a
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/request_pagination.go
@@ -0,0 +1,264 @@
+package request
+
+import (
+	"reflect"
+	"sync/atomic"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awsutil"
+)
+
+// A Pagination provides paginating of SDK API operations which are paginatable.
+// Generally you should not use this type directly, but use the "Pages" API
+// operations method to automatically perform pagination for you. Such as,
+// "S3.ListObjectsPages", and "S3.ListObjectsPagesWithContext" methods.
+//
+// Pagination differs from a Paginator type in that pagination is the type that
+// does the pagination between API operations, and Paginator defines the
+// configuration that will be used per page request.
+//
+//     cont := true
+//     for p.Next() && cont {
+//         data := p.Page().(*s3.ListObjectsOutput)
+//         // process the page's data
+//     }
+//     return p.Err()
+//
+// See service client API operation Pages methods for examples how the SDK will
+// use the Pagination type.
+type Pagination struct {
+	// Function to return a Request value for each pagination request.
+	// Any configuration or handlers that need to be applied to the request
+	// prior to getting the next page should be done here before the request
+	// returned.
+	//
+	// NewRequest should always be built from the same API operations. It is
+	// undefined if different API operations are returned on subsequent calls.
+	NewRequest func() (*Request, error)
+	// EndPageOnSameToken, when enabled, will allow the paginator to stop on
+	// token that are the same as its previous tokens.
+	EndPageOnSameToken bool
+
+	started    bool
+	prevTokens []interface{}
+	nextTokens []interface{}
+
+	err     error
+	curPage interface{}
+}
+
+// HasNextPage will return true if Pagination is able to determine that the API
+// operation has additional pages. False will be returned if there are no more
+// pages remaining.
+//
+// Will always return true if Next has not been called yet.
+func (p *Pagination) HasNextPage() bool {
+	if !p.started {
+		return true
+	}
+
+	hasNextPage := len(p.nextTokens) != 0
+	if p.EndPageOnSameToken {
+		return hasNextPage && !awsutil.DeepEqual(p.nextTokens, p.prevTokens)
+	}
+	return hasNextPage
+}
+
+// Err returns the error Pagination encountered when retrieving the next page.
+func (p *Pagination) Err() error {
+	return p.err
+}
+
+// Page returns the current page. Page should only be called after a successful
+// call to Next. It is undefined what Page will return if Page is called after
+// Next returns false.
+func (p *Pagination) Page() interface{} {
+	return p.curPage
+}
+
+// Next will attempt to retrieve the next page for the API operation. When a page
+// is retrieved true will be returned. If the page cannot be retrieved, or there
+// are no more pages false will be returned.
+//
+// Use the Page method to retrieve the current page data. The data will need
+// to be cast to the API operation's output type.
+//
+// Use the Err method to determine if an error occurred if Page returns false.
+func (p *Pagination) Next() bool {
+	if !p.HasNextPage() {
+		return false
+	}
+
+	req, err := p.NewRequest()
+	if err != nil {
+		p.err = err
+		return false
+	}
+
+	if p.started {
+		for i, intok := range req.Operation.InputTokens {
+			awsutil.SetValueAtPath(req.Params, intok, p.nextTokens[i])
+		}
+	}
+	p.started = true
+
+	err = req.Send()
+	if err != nil {
+		p.err = err
+		return false
+	}
+
+	p.prevTokens = p.nextTokens
+	p.nextTokens = req.nextPageTokens()
+	p.curPage = req.Data
+
+	return true
+}
+
+// A Paginator is the configuration data that defines how an API operation
+// should be paginated. This type is used by the API service models to define
+// the generated pagination config for service APIs.
+//
+// The Pagination type is what provides iterating between pages of an API. It
+// is only used to store the token metadata the SDK should use for performing
+// pagination.
+type Paginator struct {
+	InputTokens     []string
+	OutputTokens    []string
+	LimitToken      string
+	TruncationToken string
+}
+
+// nextPageTokens returns the tokens to use when asking for the next page of data.
+func (r *Request) nextPageTokens() []interface{} {
+	if r.Operation.Paginator == nil {
+		return nil
+	}
+	if r.Operation.TruncationToken != "" {
+		tr, _ := awsutil.ValuesAtPath(r.Data, r.Operation.TruncationToken)
+		if len(tr) == 0 {
+			return nil
+		}
+
+		switch v := tr[0].(type) {
+		case *bool:
+			if !aws.BoolValue(v) {
+				return nil
+			}
+		case bool:
+			if v == false {
+				return nil
+			}
+		}
+	}
+
+	tokens := []interface{}{}
+	tokenAdded := false
+	for _, outToken := range r.Operation.OutputTokens {
+		vs, _ := awsutil.ValuesAtPath(r.Data, outToken)
+		if len(vs) == 0 {
+			tokens = append(tokens, nil)
+			continue
+		}
+		v := vs[0]
+
+		switch tv := v.(type) {
+		case *string:
+			if len(aws.StringValue(tv)) == 0 {
+				tokens = append(tokens, nil)
+				continue
+			}
+		case string:
+			if len(tv) == 0 {
+				tokens = append(tokens, nil)
+				continue
+			}
+		}
+
+		tokenAdded = true
+		tokens = append(tokens, v)
+	}
+	if !tokenAdded {
+		return nil
+	}
+
+	return tokens
+}
+
+// Ensure a deprecated item is only logged once instead of each time its used.
+func logDeprecatedf(logger aws.Logger, flag *int32, msg string) {
+	if logger == nil {
+		return
+	}
+	if atomic.CompareAndSwapInt32(flag, 0, 1) {
+		logger.Log(msg)
+	}
+}
+
+var (
+	logDeprecatedHasNextPage int32
+	logDeprecatedNextPage    int32
+	logDeprecatedEachPage    int32
+)
+
+// HasNextPage returns true if this request has more pages of data available.
+//
+// Deprecated Use Pagination type for configurable pagination of API operations
+func (r *Request) HasNextPage() bool {
+	logDeprecatedf(r.Config.Logger, &logDeprecatedHasNextPage,
+		"Request.HasNextPage deprecated. Use Pagination type for configurable pagination of API operations")
+
+	return len(r.nextPageTokens()) > 0
+}
+
+// NextPage returns a new Request that can be executed to return the next
+// page of result data. Call .Send() on this request to execute it.
+//
+// Deprecated Use Pagination type for configurable pagination of API operations
+func (r *Request) NextPage() *Request {
+	logDeprecatedf(r.Config.Logger, &logDeprecatedNextPage,
+		"Request.NextPage deprecated. Use Pagination type for configurable pagination of API operations")
+
+	tokens := r.nextPageTokens()
+	if len(tokens) == 0 {
+		return nil
+	}
+
+	data := reflect.New(reflect.TypeOf(r.Data).Elem()).Interface()
+	nr := New(r.Config, r.ClientInfo, r.Handlers, r.Retryer, r.Operation, awsutil.CopyOf(r.Params), data)
+	for i, intok := range nr.Operation.InputTokens {
+		awsutil.SetValueAtPath(nr.Params, intok, tokens[i])
+	}
+	return nr
+}
+
+// EachPage iterates over each page of a paginated request object. The fn
+// parameter should be a function with the following sample signature:
+//
+//   func(page *T, lastPage bool) bool {
+//       return true // return false to stop iterating
+//   }
+//
+// Where "T" is the structure type matching the output structure of the given
+// operation. For example, a request object generated by
+// DynamoDB.ListTablesRequest() would expect to see dynamodb.ListTablesOutput
+// as the structure "T". The lastPage value represents whether the page is
+// the last page of data or not. The return value of this function should
+// return true to keep iterating or false to stop.
+//
+// Deprecated Use Pagination type for configurable pagination of API operations
+func (r *Request) EachPage(fn func(data interface{}, isLastPage bool) (shouldContinue bool)) error {
+	logDeprecatedf(r.Config.Logger, &logDeprecatedEachPage,
+		"Request.EachPage deprecated. Use Pagination type for configurable pagination of API operations")
+
+	for page := r; page != nil; page = page.NextPage() {
+		if err := page.Send(); err != nil {
+			return err
+		}
+		if getNextPage := fn(page.Data, !page.HasNextPage()); !getNextPage {
+			return page.Error
+		}
+	}
+
+	return nil
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/retryer.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/retryer.go
new file mode 100644
index 00000000..d0aa54c6
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/retryer.go
@@ -0,0 +1,163 @@
+package request
+
+import (
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+)
+
+// Retryer is an interface to control retry logic for a given service.
+// The default implementation used by most services is the client.DefaultRetryer
+// structure, which contains basic retry logic using exponential backoff.
+type Retryer interface {
+	RetryRules(*Request) time.Duration
+	ShouldRetry(*Request) bool
+	MaxRetries() int
+}
+
+// WithRetryer sets a config Retryer value to the given Config returning it
+// for chaining.
+func WithRetryer(cfg *aws.Config, retryer Retryer) *aws.Config {
+	cfg.Retryer = retryer
+	return cfg
+}
+
+// retryableCodes is a collection of service response codes which are retry-able
+// without any further action.
+var retryableCodes = map[string]struct{}{
+	"RequestError":            {},
+	"RequestTimeout":          {},
+	ErrCodeResponseTimeout:    {},
+	"RequestTimeoutException": {}, // Glacier's flavor of RequestTimeout
+}
+
+var throttleCodes = map[string]struct{}{
+	"ProvisionedThroughputExceededException": {},
+	"Throttling":                             {},
+	"ThrottlingException":                    {},
+	"RequestLimitExceeded":                   {},
+	"RequestThrottled":                       {},
+	"RequestThrottledException":              {},
+	"TooManyRequestsException":               {}, // Lambda functions
+	"PriorRequestNotComplete":                {}, // Route53
+	"TransactionInProgressException":         {},
+}
+
+// credsExpiredCodes is a collection of error codes which signify the credentials
+// need to be refreshed. Expired tokens require refreshing of credentials, and
+// resigning before the request can be retried.
+var credsExpiredCodes = map[string]struct{}{
+	"ExpiredToken":          {},
+	"ExpiredTokenException": {},
+	"RequestExpired":        {}, // EC2 Only
+}
+
+func isCodeThrottle(code string) bool {
+	_, ok := throttleCodes[code]
+	return ok
+}
+
+func isCodeRetryable(code string) bool {
+	if _, ok := retryableCodes[code]; ok {
+		return true
+	}
+
+	return isCodeExpiredCreds(code)
+}
+
+func isCodeExpiredCreds(code string) bool {
+	_, ok := credsExpiredCodes[code]
+	return ok
+}
+
+var validParentCodes = map[string]struct{}{
+	ErrCodeSerialization: {},
+	ErrCodeRead:          {},
+}
+
+type temporaryError interface {
+	Temporary() bool
+}
+
+func isNestedErrorRetryable(parentErr awserr.Error) bool {
+	if parentErr == nil {
+		return false
+	}
+
+	if _, ok := validParentCodes[parentErr.Code()]; !ok {
+		return false
+	}
+
+	err := parentErr.OrigErr()
+	if err == nil {
+		return false
+	}
+
+	if aerr, ok := err.(awserr.Error); ok {
+		return isCodeRetryable(aerr.Code())
+	}
+
+	if t, ok := err.(temporaryError); ok {
+		return t.Temporary() || isErrConnectionReset(err)
+	}
+
+	return isErrConnectionReset(err)
+}
+
+// IsErrorRetryable returns whether the error is retryable, based on its Code.
+// Returns false if error is nil.
+func IsErrorRetryable(err error) bool {
+	if err != nil {
+		if aerr, ok := err.(awserr.Error); ok {
+			return isCodeRetryable(aerr.Code()) || isNestedErrorRetryable(aerr)
+		}
+	}
+	return false
+}
+
+// IsErrorThrottle returns whether the error is to be throttled based on its code.
+// Returns false if error is nil.
+func IsErrorThrottle(err error) bool {
+	if err != nil {
+		if aerr, ok := err.(awserr.Error); ok {
+			return isCodeThrottle(aerr.Code())
+		}
+	}
+	return false
+}
+
+// IsErrorExpiredCreds returns whether the error code is a credential expiry error.
+// Returns false if error is nil.
+func IsErrorExpiredCreds(err error) bool {
+	if err != nil {
+		if aerr, ok := err.(awserr.Error); ok {
+			return isCodeExpiredCreds(aerr.Code())
+		}
+	}
+	return false
+}
+
+// IsErrorRetryable returns whether the error is retryable, based on its Code.
+// Returns false if the request has no Error set.
+//
+// Alias for the utility function IsErrorRetryable
+func (r *Request) IsErrorRetryable() bool {
+	return IsErrorRetryable(r.Error)
+}
+
+// IsErrorThrottle returns whether the error is to be throttled based on its code.
+// Returns false if the request has no Error set
+//
+// Alias for the utility function IsErrorThrottle
+func (r *Request) IsErrorThrottle() bool {
+	return IsErrorThrottle(r.Error)
+}
+
+// IsErrorExpired returns whether the error code is a credential expiry error.
+// Returns false if the request has no Error set.
+//
+// Alias for the utility function IsErrorExpiredCreds
+func (r *Request) IsErrorExpired() bool {
+	return IsErrorExpiredCreds(r.Error)
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/timeout_read_closer.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/timeout_read_closer.go
new file mode 100644
index 00000000..09a44eb9
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/timeout_read_closer.go
@@ -0,0 +1,94 @@
+package request
+
+import (
+	"io"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws/awserr"
+)
+
+var timeoutErr = awserr.New(
+	ErrCodeResponseTimeout,
+	"read on body has reached the timeout limit",
+	nil,
+)
+
+type readResult struct {
+	n   int
+	err error
+}
+
+// timeoutReadCloser will handle body reads that take too long.
+// We will return a ErrReadTimeout error if a timeout occurs.
+type timeoutReadCloser struct {
+	reader   io.ReadCloser
+	duration time.Duration
+}
+
+// Read will spin off a goroutine to call the reader's Read method. We will
+// select on the timer's channel or the read's channel. Whoever completes first
+// will be returned.
+func (r *timeoutReadCloser) Read(b []byte) (int, error) {
+	timer := time.NewTimer(r.duration)
+	c := make(chan readResult, 1)
+
+	go func() {
+		n, err := r.reader.Read(b)
+		timer.Stop()
+		c <- readResult{n: n, err: err}
+	}()
+
+	select {
+	case data := <-c:
+		return data.n, data.err
+	case <-timer.C:
+		return 0, timeoutErr
+	}
+}
+
+func (r *timeoutReadCloser) Close() error {
+	return r.reader.Close()
+}
+
+const (
+	// HandlerResponseTimeout is what we use to signify the name of the
+	// response timeout handler.
+	HandlerResponseTimeout = "ResponseTimeoutHandler"
+)
+
+// adaptToResponseTimeoutError is a handler that will replace any top level error
+// to a ErrCodeResponseTimeout, if its child is that.
+func adaptToResponseTimeoutError(req *Request) {
+	if err, ok := req.Error.(awserr.Error); ok {
+		aerr, ok := err.OrigErr().(awserr.Error)
+		if ok && aerr.Code() == ErrCodeResponseTimeout {
+			req.Error = aerr
+		}
+	}
+}
+
+// WithResponseReadTimeout is a request option that will wrap the body in a timeout read closer.
+// This will allow for per read timeouts. If a timeout occurred, we will return the
+// ErrCodeResponseTimeout.
+//
+//     svc.PutObjectWithContext(ctx, params, request.WithTimeoutReadCloser(30 * time.Second)
+func WithResponseReadTimeout(duration time.Duration) Option {
+	return func(r *Request) {
+
+		var timeoutHandler = NamedHandler{
+			HandlerResponseTimeout,
+			func(req *Request) {
+				req.HTTPResponse.Body = &timeoutReadCloser{
+					reader:   req.HTTPResponse.Body,
+					duration: duration,
+				}
+			}}
+
+		// remove the handler so we are not stomping over any new durations.
+		r.Handlers.Send.RemoveByName(HandlerResponseTimeout)
+		r.Handlers.Send.PushBackNamed(timeoutHandler)
+
+		r.Handlers.Unmarshal.PushBack(adaptToResponseTimeoutError)
+		r.Handlers.UnmarshalError.PushBack(adaptToResponseTimeoutError)
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/validation.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/validation.go
new file mode 100644
index 00000000..8630683f
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/validation.go
@@ -0,0 +1,286 @@
+package request
+
+import (
+	"bytes"
+	"fmt"
+
+	"github.com/aws/aws-sdk-go/aws/awserr"
+)
+
+const (
+	// InvalidParameterErrCode is the error code for invalid parameters errors
+	InvalidParameterErrCode = "InvalidParameter"
+	// ParamRequiredErrCode is the error code for required parameter errors
+	ParamRequiredErrCode = "ParamRequiredError"
+	// ParamMinValueErrCode is the error code for fields with too low of a
+	// number value.
+	ParamMinValueErrCode = "ParamMinValueError"
+	// ParamMinLenErrCode is the error code for fields without enough elements.
+	ParamMinLenErrCode = "ParamMinLenError"
+	// ParamMaxLenErrCode is the error code for value being too long.
+	ParamMaxLenErrCode = "ParamMaxLenError"
+
+	// ParamFormatErrCode is the error code for a field with invalid
+	// format or characters.
+	ParamFormatErrCode = "ParamFormatInvalidError"
+)
+
+// Validator provides a way for types to perform validation logic on their
+// input values that external code can use to determine if a type's values
+// are valid.
+type Validator interface {
+	Validate() error
+}
+
+// An ErrInvalidParams provides wrapping of invalid parameter errors found when
+// validating API operation input parameters.
+type ErrInvalidParams struct {
+	// Context is the base context of the invalid parameter group.
+	Context string
+	errs    []ErrInvalidParam
+}
+
+// Add adds a new invalid parameter error to the collection of invalid
+// parameters. The context of the invalid parameter will be updated to reflect
+// this collection.
+func (e *ErrInvalidParams) Add(err ErrInvalidParam) {
+	err.SetContext(e.Context)
+	e.errs = append(e.errs, err)
+}
+
+// AddNested adds the invalid parameter errors from another ErrInvalidParams
+// value into this collection. The nested errors will have their nested context
+// updated and base context to reflect the merging.
+//
+// Use for nested validations errors.
+func (e *ErrInvalidParams) AddNested(nestedCtx string, nested ErrInvalidParams) {
+	for _, err := range nested.errs {
+		err.SetContext(e.Context)
+		err.AddNestedContext(nestedCtx)
+		e.errs = append(e.errs, err)
+	}
+}
+
+// Len returns the number of invalid parameter errors
+func (e ErrInvalidParams) Len() int {
+	return len(e.errs)
+}
+
+// Code returns the code of the error
+func (e ErrInvalidParams) Code() string {
+	return InvalidParameterErrCode
+}
+
+// Message returns the message of the error
+func (e ErrInvalidParams) Message() string {
+	return fmt.Sprintf("%d validation error(s) found.", len(e.errs))
+}
+
+// Error returns the string formatted form of the invalid parameters.
+func (e ErrInvalidParams) Error() string {
+	w := &bytes.Buffer{}
+	fmt.Fprintf(w, "%s: %s\n", e.Code(), e.Message())
+
+	for _, err := range e.errs {
+		fmt.Fprintf(w, "- %s\n", err.Message())
+	}
+
+	return w.String()
+}
+
+// OrigErr returns the invalid parameters as a awserr.BatchedErrors value
+func (e ErrInvalidParams) OrigErr() error {
+	return awserr.NewBatchError(
+		InvalidParameterErrCode, e.Message(), e.OrigErrs())
+}
+
+// OrigErrs returns a slice of the invalid parameters
+func (e ErrInvalidParams) OrigErrs() []error {
+	errs := make([]error, len(e.errs))
+	for i := 0; i < len(errs); i++ {
+		errs[i] = e.errs[i]
+	}
+
+	return errs
+}
+
+// An ErrInvalidParam represents an invalid parameter error type.
+type ErrInvalidParam interface {
+	awserr.Error
+
+	// Field name the error occurred on.
+	Field() string
+
+	// SetContext updates the context of the error.
+	SetContext(string)
+
+	// AddNestedContext updates the error's context to include a nested level.
+	AddNestedContext(string)
+}
+
+type errInvalidParam struct {
+	context       string
+	nestedContext string
+	field         string
+	code          string
+	msg           string
+}
+
+// Code returns the error code for the type of invalid parameter.
+func (e *errInvalidParam) Code() string {
+	return e.code
+}
+
+// Message returns the reason the parameter was invalid, and its context.
+func (e *errInvalidParam) Message() string {
+	return fmt.Sprintf("%s, %s.", e.msg, e.Field())
+}
+
+// Error returns the string version of the invalid parameter error.
+func (e *errInvalidParam) Error() string {
+	return fmt.Sprintf("%s: %s", e.code, e.Message())
+}
+
+// OrigErr returns nil, Implemented for awserr.Error interface.
+func (e *errInvalidParam) OrigErr() error {
+	return nil
+}
+
+// Field Returns the field and context the error occurred.
+func (e *errInvalidParam) Field() string {
+	field := e.context
+	if len(field) > 0 {
+		field += "."
+	}
+	if len(e.nestedContext) > 0 {
+		field += fmt.Sprintf("%s.", e.nestedContext)
+	}
+	field += e.field
+
+	return field
+}
+
+// SetContext updates the base context of the error.
+func (e *errInvalidParam) SetContext(ctx string) {
+	e.context = ctx
+}
+
+// AddNestedContext prepends a context to the field's path.
+func (e *errInvalidParam) AddNestedContext(ctx string) {
+	if len(e.nestedContext) == 0 {
+		e.nestedContext = ctx
+	} else {
+		e.nestedContext = fmt.Sprintf("%s.%s", ctx, e.nestedContext)
+	}
+
+}
+
+// An ErrParamRequired represents an required parameter error.
+type ErrParamRequired struct {
+	errInvalidParam
+}
+
+// NewErrParamRequired creates a new required parameter error.
+func NewErrParamRequired(field string) *ErrParamRequired {
+	return &ErrParamRequired{
+		errInvalidParam{
+			code:  ParamRequiredErrCode,
+			field: field,
+			msg:   fmt.Sprintf("missing required field"),
+		},
+	}
+}
+
+// An ErrParamMinValue represents a minimum value parameter error.
+type ErrParamMinValue struct {
+	errInvalidParam
+	min float64
+}
+
+// NewErrParamMinValue creates a new minimum value parameter error.
+func NewErrParamMinValue(field string, min float64) *ErrParamMinValue {
+	return &ErrParamMinValue{
+		errInvalidParam: errInvalidParam{
+			code:  ParamMinValueErrCode,
+			field: field,
+			msg:   fmt.Sprintf("minimum field value of %v", min),
+		},
+		min: min,
+	}
+}
+
+// MinValue returns the field's require minimum value.
+//
+// float64 is returned for both int and float min values.
+func (e *ErrParamMinValue) MinValue() float64 {
+	return e.min
+}
+
+// An ErrParamMinLen represents a minimum length parameter error.
+type ErrParamMinLen struct {
+	errInvalidParam
+	min int
+}
+
+// NewErrParamMinLen creates a new minimum length parameter error.
+func NewErrParamMinLen(field string, min int) *ErrParamMinLen {
+	return &ErrParamMinLen{
+		errInvalidParam: errInvalidParam{
+			code:  ParamMinLenErrCode,
+			field: field,
+			msg:   fmt.Sprintf("minimum field size of %v", min),
+		},
+		min: min,
+	}
+}
+
+// MinLen returns the field's required minimum length.
+func (e *ErrParamMinLen) MinLen() int {
+	return e.min
+}
+
+// An ErrParamMaxLen represents a maximum length parameter error.
+type ErrParamMaxLen struct {
+	errInvalidParam
+	max int
+}
+
+// NewErrParamMaxLen creates a new maximum length parameter error.
+func NewErrParamMaxLen(field string, max int, value string) *ErrParamMaxLen {
+	return &ErrParamMaxLen{
+		errInvalidParam: errInvalidParam{
+			code:  ParamMaxLenErrCode,
+			field: field,
+			msg:   fmt.Sprintf("maximum size of %v, %v", max, value),
+		},
+		max: max,
+	}
+}
+
+// MaxLen returns the field's required minimum length.
+func (e *ErrParamMaxLen) MaxLen() int {
+	return e.max
+}
+
+// An ErrParamFormat represents a invalid format parameter error.
+type ErrParamFormat struct {
+	errInvalidParam
+	format string
+}
+
+// NewErrParamFormat creates a new invalid format parameter error.
+func NewErrParamFormat(field string, format, value string) *ErrParamFormat {
+	return &ErrParamFormat{
+		errInvalidParam: errInvalidParam{
+			code:  ParamFormatErrCode,
+			field: field,
+			msg:   fmt.Sprintf("format %v, %v", format, value),
+		},
+		format: format,
+	}
+}
+
+// Format returns the field's required format.
+func (e *ErrParamFormat) Format() string {
+	return e.format
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/waiter.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/waiter.go
new file mode 100644
index 00000000..4601f883
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/request/waiter.go
@@ -0,0 +1,295 @@
+package request
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	"github.com/aws/aws-sdk-go/aws/awsutil"
+)
+
+// WaiterResourceNotReadyErrorCode is the error code returned by a waiter when
+// the waiter's max attempts have been exhausted.
+const WaiterResourceNotReadyErrorCode = "ResourceNotReady"
+
+// A WaiterOption is a function that will update the Waiter value's fields to
+// configure the waiter.
+type WaiterOption func(*Waiter)
+
+// WithWaiterMaxAttempts returns the maximum number of times the waiter should
+// attempt to check the resource for the target state.
+func WithWaiterMaxAttempts(max int) WaiterOption {
+	return func(w *Waiter) {
+		w.MaxAttempts = max
+	}
+}
+
+// WaiterDelay will return a delay the waiter should pause between attempts to
+// check the resource state. The passed in attempt is the number of times the
+// Waiter has checked the resource state.
+//
+// Attempt is the number of attempts the Waiter has made checking the resource
+// state.
+type WaiterDelay func(attempt int) time.Duration
+
+// ConstantWaiterDelay returns a WaiterDelay that will always return a constant
+// delay the waiter should use between attempts. It ignores the number of
+// attempts made.
+func ConstantWaiterDelay(delay time.Duration) WaiterDelay {
+	return func(attempt int) time.Duration {
+		return delay
+	}
+}
+
+// WithWaiterDelay will set the Waiter to use the WaiterDelay passed in.
+func WithWaiterDelay(delayer WaiterDelay) WaiterOption {
+	return func(w *Waiter) {
+		w.Delay = delayer
+	}
+}
+
+// WithWaiterLogger returns a waiter option to set the logger a waiter
+// should use to log warnings and errors to.
+func WithWaiterLogger(logger aws.Logger) WaiterOption {
+	return func(w *Waiter) {
+		w.Logger = logger
+	}
+}
+
+// WithWaiterRequestOptions returns a waiter option setting the request
+// options for each request the waiter makes. Appends to waiter's request
+// options already set.
+func WithWaiterRequestOptions(opts ...Option) WaiterOption {
+	return func(w *Waiter) {
+		w.RequestOptions = append(w.RequestOptions, opts...)
+	}
+}
+
+// A Waiter provides the functionality to perform a blocking call which will
+// wait for a resource state to be satisfied by a service.
+//
+// This type should not be used directly. The API operations provided in the
+// service packages prefixed with "WaitUntil" should be used instead.
+type Waiter struct {
+	Name      string
+	Acceptors []WaiterAcceptor
+	Logger    aws.Logger
+
+	MaxAttempts int
+	Delay       WaiterDelay
+
+	RequestOptions   []Option
+	NewRequest       func([]Option) (*Request, error)
+	SleepWithContext func(aws.Context, time.Duration) error
+}
+
+// ApplyOptions updates the waiter with the list of waiter options provided.
+func (w *Waiter) ApplyOptions(opts ...WaiterOption) {
+	for _, fn := range opts {
+		fn(w)
+	}
+}
+
+// WaiterState are states the waiter uses based on WaiterAcceptor definitions
+// to identify if the resource state the waiter is waiting on has occurred.
+type WaiterState int
+
+// String returns the string representation of the waiter state.
+func (s WaiterState) String() string {
+	switch s {
+	case SuccessWaiterState:
+		return "success"
+	case FailureWaiterState:
+		return "failure"
+	case RetryWaiterState:
+		return "retry"
+	default:
+		return "unknown waiter state"
+	}
+}
+
+// States the waiter acceptors will use to identify target resource states.
+const (
+	SuccessWaiterState WaiterState = iota // waiter successful
+	FailureWaiterState                    // waiter failed
+	RetryWaiterState                      // waiter needs to be retried
+)
+
+// WaiterMatchMode is the mode that the waiter will use to match the WaiterAcceptor
+// definition's Expected attribute.
+type WaiterMatchMode int
+
+// Modes the waiter will use when inspecting API response to identify target
+// resource states.
+const (
+	PathAllWaiterMatch  WaiterMatchMode = iota // match on all paths
+	PathWaiterMatch                            // match on specific path
+	PathAnyWaiterMatch                         // match on any path
+	PathListWaiterMatch                        // match on list of paths
+	StatusWaiterMatch                          // match on status code
+	ErrorWaiterMatch                           // match on error
+)
+
+// String returns the string representation of the waiter match mode.
+func (m WaiterMatchMode) String() string {
+	switch m {
+	case PathAllWaiterMatch:
+		return "pathAll"
+	case PathWaiterMatch:
+		return "path"
+	case PathAnyWaiterMatch:
+		return "pathAny"
+	case PathListWaiterMatch:
+		return "pathList"
+	case StatusWaiterMatch:
+		return "status"
+	case ErrorWaiterMatch:
+		return "error"
+	default:
+		return "unknown waiter match mode"
+	}
+}
+
+// WaitWithContext will make requests for the API operation using NewRequest to
+// build API requests. The request's response will be compared against the
+// Waiter's Acceptors to determine the successful state of the resource the
+// waiter is inspecting.
+//
+// The passed in context must not be nil. If it is nil a panic will occur. The
+// Context will be used to cancel the waiter's pending requests and retry delays.
+// Use aws.BackgroundContext if no context is available.
+//
+// The waiter will continue until the target state defined by the Acceptors,
+// or the max attempts expires.
+//
+// Will return the WaiterResourceNotReadyErrorCode error code if the waiter's
+// retryer ShouldRetry returns false. This normally will happen when the max
+// wait attempts expires.
+func (w Waiter) WaitWithContext(ctx aws.Context) error {
+
+	for attempt := 1; ; attempt++ {
+		req, err := w.NewRequest(w.RequestOptions)
+		if err != nil {
+			waiterLogf(w.Logger, "unable to create request %v", err)
+			return err
+		}
+		req.Handlers.Build.PushBack(MakeAddToUserAgentFreeFormHandler("Waiter"))
+		err = req.Send()
+
+		// See if any of the acceptors match the request's response, or error
+		for _, a := range w.Acceptors {
+			if matched, matchErr := a.match(w.Name, w.Logger, req, err); matched {
+				return matchErr
+			}
+		}
+
+		// The Waiter should only check the resource state MaxAttempts times
+		// This is here instead of in the for loop above to prevent delaying
+		// unnecessary when the waiter will not retry.
+		if attempt == w.MaxAttempts {
+			break
+		}
+
+		// Delay to wait before inspecting the resource again
+		delay := w.Delay(attempt)
+		if sleepFn := req.Config.SleepDelay; sleepFn != nil {
+			// Support SleepDelay for backwards compatibility and testing
+			sleepFn(delay)
+		} else {
+			sleepCtxFn := w.SleepWithContext
+			if sleepCtxFn == nil {
+				sleepCtxFn = aws.SleepWithContext
+			}
+
+			if err := sleepCtxFn(ctx, delay); err != nil {
+				return awserr.New(CanceledErrorCode, "waiter context canceled", err)
+			}
+		}
+	}
+
+	return awserr.New(WaiterResourceNotReadyErrorCode, "exceeded wait attempts", nil)
+}
+
+// A WaiterAcceptor provides the information needed to wait for an API operation
+// to complete.
+type WaiterAcceptor struct {
+	State    WaiterState
+	Matcher  WaiterMatchMode
+	Argument string
+	Expected interface{}
+}
+
+// match returns if the acceptor found a match with the passed in request
+// or error. True is returned if the acceptor made a match, error is returned
+// if there was an error attempting to perform the match.
+func (a *WaiterAcceptor) match(name string, l aws.Logger, req *Request, err error) (bool, error) {
+	result := false
+	var vals []interface{}
+
+	switch a.Matcher {
+	case PathAllWaiterMatch, PathWaiterMatch:
+		// Require all matches to be equal for result to match
+		vals, _ = awsutil.ValuesAtPath(req.Data, a.Argument)
+		if len(vals) == 0 {
+			break
+		}
+		result = true
+		for _, val := range vals {
+			if !awsutil.DeepEqual(val, a.Expected) {
+				result = false
+				break
+			}
+		}
+	case PathAnyWaiterMatch:
+		// Only a single match needs to equal for the result to match
+		vals, _ = awsutil.ValuesAtPath(req.Data, a.Argument)
+		for _, val := range vals {
+			if awsutil.DeepEqual(val, a.Expected) {
+				result = true
+				break
+			}
+		}
+	case PathListWaiterMatch:
+		// ignored matcher
+	case StatusWaiterMatch:
+		s := a.Expected.(int)
+		result = s == req.HTTPResponse.StatusCode
+	case ErrorWaiterMatch:
+		if aerr, ok := err.(awserr.Error); ok {
+			result = aerr.Code() == a.Expected.(string)
+		}
+	default:
+		waiterLogf(l, "WARNING: Waiter %s encountered unexpected matcher: %s",
+			name, a.Matcher)
+	}
+
+	if !result {
+		// If there was no matching result found there is nothing more to do
+		// for this response, retry the request.
+		return false, nil
+	}
+
+	switch a.State {
+	case SuccessWaiterState:
+		// waiter completed
+		return true, nil
+	case FailureWaiterState:
+		// Waiter failure state triggered
+		return true, awserr.New(WaiterResourceNotReadyErrorCode,
+			"failed waiting for successful resource state", err)
+	case RetryWaiterState:
+		// clear the error and retry the operation
+		return false, nil
+	default:
+		waiterLogf(l, "WARNING: Waiter %s encountered unexpected state: %s",
+			name, a.State)
+		return false, nil
+	}
+}
+
+func waiterLogf(logger aws.Logger, msg string, args ...interface{}) {
+	if logger != nil {
+		logger.Log(fmt.Sprintf(msg, args...))
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/types.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/types.go
new file mode 100644
index 00000000..8b6f2342
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/types.go
@@ -0,0 +1,201 @@
+package aws
+
+import (
+	"io"
+	"sync"
+
+	"github.com/aws/aws-sdk-go/internal/sdkio"
+)
+
+// ReadSeekCloser wraps a io.Reader returning a ReaderSeekerCloser. Should
+// only be used with an io.Reader that is also an io.Seeker. Doing so may
+// cause request signature errors, or request body's not sent for GET, HEAD
+// and DELETE HTTP methods.
+//
+// Deprecated: Should only be used with io.ReadSeeker. If using for
+// S3 PutObject to stream content use s3manager.Uploader instead.
+func ReadSeekCloser(r io.Reader) ReaderSeekerCloser {
+	return ReaderSeekerCloser{r}
+}
+
+// ReaderSeekerCloser represents a reader that can also delegate io.Seeker and
+// io.Closer interfaces to the underlying object if they are available.
+type ReaderSeekerCloser struct {
+	r io.Reader
+}
+
+// IsReaderSeekable returns if the underlying reader type can be seeked. A
+// io.Reader might not actually be seekable if it is the ReaderSeekerCloser
+// type.
+func IsReaderSeekable(r io.Reader) bool {
+	switch v := r.(type) {
+	case ReaderSeekerCloser:
+		return v.IsSeeker()
+	case *ReaderSeekerCloser:
+		return v.IsSeeker()
+	case io.ReadSeeker:
+		return true
+	default:
+		return false
+	}
+}
+
+// Read reads from the reader up to size of p. The number of bytes read, and
+// error if it occurred will be returned.
+//
+// If the reader is not an io.Reader zero bytes read, and nil error will be returned.
+//
+// Performs the same functionality as io.Reader Read
+func (r ReaderSeekerCloser) Read(p []byte) (int, error) {
+	switch t := r.r.(type) {
+	case io.Reader:
+		return t.Read(p)
+	}
+	return 0, nil
+}
+
+// Seek sets the offset for the next Read to offset, interpreted according to
+// whence: 0 means relative to the origin of the file, 1 means relative to the
+// current offset, and 2 means relative to the end. Seek returns the new offset
+// and an error, if any.
+//
+// If the ReaderSeekerCloser is not an io.Seeker nothing will be done.
+func (r ReaderSeekerCloser) Seek(offset int64, whence int) (int64, error) {
+	switch t := r.r.(type) {
+	case io.Seeker:
+		return t.Seek(offset, whence)
+	}
+	return int64(0), nil
+}
+
+// IsSeeker returns if the underlying reader is also a seeker.
+func (r ReaderSeekerCloser) IsSeeker() bool {
+	_, ok := r.r.(io.Seeker)
+	return ok
+}
+
+// HasLen returns the length of the underlying reader if the value implements
+// the Len() int method.
+func (r ReaderSeekerCloser) HasLen() (int, bool) {
+	type lenner interface {
+		Len() int
+	}
+
+	if lr, ok := r.r.(lenner); ok {
+		return lr.Len(), true
+	}
+
+	return 0, false
+}
+
+// GetLen returns the length of the bytes remaining in the underlying reader.
+// Checks first for Len(), then io.Seeker to determine the size of the
+// underlying reader.
+//
+// Will return -1 if the length cannot be determined.
+func (r ReaderSeekerCloser) GetLen() (int64, error) {
+	if l, ok := r.HasLen(); ok {
+		return int64(l), nil
+	}
+
+	if s, ok := r.r.(io.Seeker); ok {
+		return seekerLen(s)
+	}
+
+	return -1, nil
+}
+
+// SeekerLen attempts to get the number of bytes remaining at the seeker's
+// current position.  Returns the number of bytes remaining or error.
+func SeekerLen(s io.Seeker) (int64, error) {
+	// Determine if the seeker is actually seekable. ReaderSeekerCloser
+	// hides the fact that a io.Readers might not actually be seekable.
+	switch v := s.(type) {
+	case ReaderSeekerCloser:
+		return v.GetLen()
+	case *ReaderSeekerCloser:
+		return v.GetLen()
+	}
+
+	return seekerLen(s)
+}
+
+func seekerLen(s io.Seeker) (int64, error) {
+	curOffset, err := s.Seek(0, sdkio.SeekCurrent)
+	if err != nil {
+		return 0, err
+	}
+
+	endOffset, err := s.Seek(0, sdkio.SeekEnd)
+	if err != nil {
+		return 0, err
+	}
+
+	_, err = s.Seek(curOffset, sdkio.SeekStart)
+	if err != nil {
+		return 0, err
+	}
+
+	return endOffset - curOffset, nil
+}
+
+// Close closes the ReaderSeekerCloser.
+//
+// If the ReaderSeekerCloser is not an io.Closer nothing will be done.
+func (r ReaderSeekerCloser) Close() error {
+	switch t := r.r.(type) {
+	case io.Closer:
+		return t.Close()
+	}
+	return nil
+}
+
+// A WriteAtBuffer provides a in memory buffer supporting the io.WriterAt interface
+// Can be used with the s3manager.Downloader to download content to a buffer
+// in memory. Safe to use concurrently.
+type WriteAtBuffer struct {
+	buf []byte
+	m   sync.Mutex
+
+	// GrowthCoeff defines the growth rate of the internal buffer. By
+	// default, the growth rate is 1, where expanding the internal
+	// buffer will allocate only enough capacity to fit the new expected
+	// length.
+	GrowthCoeff float64
+}
+
+// NewWriteAtBuffer creates a WriteAtBuffer with an internal buffer
+// provided by buf.
+func NewWriteAtBuffer(buf []byte) *WriteAtBuffer {
+	return &WriteAtBuffer{buf: buf}
+}
+
+// WriteAt writes a slice of bytes to a buffer starting at the position provided
+// The number of bytes written will be returned, or error. Can overwrite previous
+// written slices if the write ats overlap.
+func (b *WriteAtBuffer) WriteAt(p []byte, pos int64) (n int, err error) {
+	pLen := len(p)
+	expLen := pos + int64(pLen)
+	b.m.Lock()
+	defer b.m.Unlock()
+	if int64(len(b.buf)) < expLen {
+		if int64(cap(b.buf)) < expLen {
+			if b.GrowthCoeff < 1 {
+				b.GrowthCoeff = 1
+			}
+			newBuf := make([]byte, expLen, int64(b.GrowthCoeff*float64(expLen)))
+			copy(newBuf, b.buf)
+			b.buf = newBuf
+		}
+		b.buf = b.buf[:expLen]
+	}
+	copy(b.buf[pos:], p)
+	return pLen, nil
+}
+
+// Bytes returns a slice of bytes written to the buffer.
+func (b *WriteAtBuffer) Bytes() []byte {
+	b.m.Lock()
+	defer b.m.Unlock()
+	return b.buf
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/url.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/url.go
new file mode 100644
index 00000000..6192b245
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/url.go
@@ -0,0 +1,12 @@
+// +build go1.8
+
+package aws
+
+import "net/url"
+
+// URLHostname will extract the Hostname without port from the URL value.
+//
+// Wrapper of net/url#URL.Hostname for backwards Go version compatibility.
+func URLHostname(url *url.URL) string {
+	return url.Hostname()
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/url_1_7.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/url_1_7.go
new file mode 100644
index 00000000..0210d272
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/url_1_7.go
@@ -0,0 +1,29 @@
+// +build !go1.8
+
+package aws
+
+import (
+	"net/url"
+	"strings"
+)
+
+// URLHostname will extract the Hostname without port from the URL value.
+//
+// Copy of Go 1.8's net/url#URL.Hostname functionality.
+func URLHostname(url *url.URL) string {
+	return stripPort(url.Host)
+
+}
+
+// stripPort is copy of Go 1.8 url#URL.Hostname functionality.
+// https://golang.org/src/net/url/url.go
+func stripPort(hostport string) string {
+	colon := strings.IndexByte(hostport, ':')
+	if colon == -1 {
+		return hostport
+	}
+	if i := strings.IndexByte(hostport, ']'); i != -1 {
+		return strings.TrimPrefix(hostport[:i], "[")
+	}
+	return hostport[:colon]
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/version.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/version.go
new file mode 100644
index 00000000..b3644a1e
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/aws/version.go
@@ -0,0 +1,8 @@
+// Package aws provides core functionality for making requests to AWS services.
+package aws
+
+// SDKName is the name of this AWS SDK
+const SDKName = "aws-sdk-go"
+
+// SDKVersion is the version of this SDK
+const SDKVersion = "1.19.0"
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/ast.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/ast.go
new file mode 100644
index 00000000..e83a9988
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/ast.go
@@ -0,0 +1,120 @@
+package ini
+
+// ASTKind represents different states in the parse table
+// and the type of AST that is being constructed
+type ASTKind int
+
+// ASTKind* is used in the parse table to transition between
+// the different states
+const (
+	ASTKindNone = ASTKind(iota)
+	ASTKindStart
+	ASTKindExpr
+	ASTKindEqualExpr
+	ASTKindStatement
+	ASTKindSkipStatement
+	ASTKindExprStatement
+	ASTKindSectionStatement
+	ASTKindNestedSectionStatement
+	ASTKindCompletedNestedSectionStatement
+	ASTKindCommentStatement
+	ASTKindCompletedSectionStatement
+)
+
+func (k ASTKind) String() string {
+	switch k {
+	case ASTKindNone:
+		return "none"
+	case ASTKindStart:
+		return "start"
+	case ASTKindExpr:
+		return "expr"
+	case ASTKindStatement:
+		return "stmt"
+	case ASTKindSectionStatement:
+		return "section_stmt"
+	case ASTKindExprStatement:
+		return "expr_stmt"
+	case ASTKindCommentStatement:
+		return "comment"
+	case ASTKindNestedSectionStatement:
+		return "nested_section_stmt"
+	case ASTKindCompletedSectionStatement:
+		return "completed_stmt"
+	case ASTKindSkipStatement:
+		return "skip"
+	default:
+		return ""
+	}
+}
+
+// AST interface allows us to determine what kind of node we
+// are on and casting may not need to be necessary.
+//
+// The root is always the first node in Children
+type AST struct {
+	Kind      ASTKind
+	Root      Token
+	RootToken bool
+	Children  []AST
+}
+
+func newAST(kind ASTKind, root AST, children ...AST) AST {
+	return AST{
+		Kind:     kind,
+		Children: append([]AST{root}, children...),
+	}
+}
+
+func newASTWithRootToken(kind ASTKind, root Token, children ...AST) AST {
+	return AST{
+		Kind:      kind,
+		Root:      root,
+		RootToken: true,
+		Children:  children,
+	}
+}
+
+// AppendChild will append to the list of children an AST has.
+func (a *AST) AppendChild(child AST) {
+	a.Children = append(a.Children, child)
+}
+
+// GetRoot will return the root AST which can be the first entry
+// in the children list or a token.
+func (a *AST) GetRoot() AST {
+	if a.RootToken {
+		return *a
+	}
+
+	if len(a.Children) == 0 {
+		return AST{}
+	}
+
+	return a.Children[0]
+}
+
+// GetChildren will return the current AST's list of children
+func (a *AST) GetChildren() []AST {
+	if len(a.Children) == 0 {
+		return []AST{}
+	}
+
+	if a.RootToken {
+		return a.Children
+	}
+
+	return a.Children[1:]
+}
+
+// SetChildren will set and override all children of the AST.
+func (a *AST) SetChildren(children []AST) {
+	if a.RootToken {
+		a.Children = children
+	} else {
+		a.Children = append(a.Children[:1], children...)
+	}
+}
+
+// Start is used to indicate the starting state of the parse table.
+var Start = newAST(ASTKindStart, AST{})
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/comma_token.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/comma_token.go
new file mode 100644
index 00000000..0895d53c
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/comma_token.go
@@ -0,0 +1,11 @@
+package ini
+
+var commaRunes = []rune(",")
+
+func isComma(b rune) bool {
+	return b == ','
+}
+
+func newCommaToken() Token {
+	return newToken(TokenComma, commaRunes, NoneType)
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/comment_token.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/comment_token.go
new file mode 100644
index 00000000..0b76999b
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/comment_token.go
@@ -0,0 +1,35 @@
+package ini
+
+// isComment will return whether or not the next byte(s) is a
+// comment.
+func isComment(b []rune) bool {
+	if len(b) == 0 {
+		return false
+	}
+
+	switch b[0] {
+	case ';':
+		return true
+	case '#':
+		return true
+	}
+
+	return false
+}
+
+// newCommentToken will create a comment token and
+// return how many bytes were read.
+func newCommentToken(b []rune) (Token, int, error) {
+	i := 0
+	for ; i < len(b); i++ {
+		if b[i] == '\n' {
+			break
+		}
+
+		if len(b)-i > 2 && b[i] == '\r' && b[i+1] == '\n' {
+			break
+		}
+	}
+
+	return newToken(TokenComment, b[:i], NoneType), i, nil
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/doc.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/doc.go
new file mode 100644
index 00000000..25ce0fe1
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/doc.go
@@ -0,0 +1,29 @@
+// Package ini is an LL(1) parser for configuration files.
+//
+//	Example:
+//	sections, err := ini.OpenFile("/path/to/file")
+//	if err != nil {
+//		panic(err)
+//	}
+//
+//	profile := "foo"
+//	section, ok := sections.GetSection(profile)
+//	if !ok {
+//		fmt.Printf("section %q could not be found", profile)
+//	}
+//
+// Below is the BNF that describes this parser
+//	Grammar:
+//	stmt -> value stmt'
+//	stmt' -> epsilon | op stmt
+//	value -> number | string | boolean | quoted_string
+//
+//	section -> [ section'
+//	section' -> value section_close
+//	section_close -> ]
+//
+//	SkipState will skip (NL WS)+
+//
+//	comment -> # comment' | ; comment'
+//	comment' -> epsilon | value
+package ini
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/empty_token.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/empty_token.go
new file mode 100644
index 00000000..04345a54
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/empty_token.go
@@ -0,0 +1,4 @@
+package ini
+
+// emptyToken is used to satisfy the Token interface
+var emptyToken = newToken(TokenNone, []rune{}, NoneType)
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/expression.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/expression.go
new file mode 100644
index 00000000..91ba2a59
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/expression.go
@@ -0,0 +1,24 @@
+package ini
+
+// newExpression will return an expression AST.
+// Expr represents an expression
+//
+//	grammar:
+//	expr -> string | number
+func newExpression(tok Token) AST {
+	return newASTWithRootToken(ASTKindExpr, tok)
+}
+
+func newEqualExpr(left AST, tok Token) AST {
+	return newASTWithRootToken(ASTKindEqualExpr, tok, left)
+}
+
+// EqualExprKey will return a LHS value in the equal expr
+func EqualExprKey(ast AST) string {
+	children := ast.GetChildren()
+	if len(children) == 0 || ast.Kind != ASTKindEqualExpr {
+		return ""
+	}
+
+	return string(children[0].Root.Raw())
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/fuzz.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/fuzz.go
new file mode 100644
index 00000000..8d462f77
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/fuzz.go
@@ -0,0 +1,17 @@
+// +build gofuzz
+
+package ini
+
+import (
+	"bytes"
+)
+
+func Fuzz(data []byte) int {
+	b := bytes.NewReader(data)
+
+	if _, err := Parse(b); err != nil {
+		return 0
+	}
+
+	return 1
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/ini.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/ini.go
new file mode 100644
index 00000000..3b0ca7af
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/ini.go
@@ -0,0 +1,51 @@
+package ini
+
+import (
+	"io"
+	"os"
+
+	"github.com/aws/aws-sdk-go/aws/awserr"
+)
+
+// OpenFile takes a path to a given file, and will open  and parse
+// that file.
+func OpenFile(path string) (Sections, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return Sections{}, awserr.New(ErrCodeUnableToReadFile, "unable to open file", err)
+	}
+	defer f.Close()
+
+	return Parse(f)
+}
+
+// Parse will parse the given file using the shared config
+// visitor.
+func Parse(f io.Reader) (Sections, error) {
+	tree, err := ParseAST(f)
+	if err != nil {
+		return Sections{}, err
+	}
+
+	v := NewDefaultVisitor()
+	if err = Walk(tree, v); err != nil {
+		return Sections{}, err
+	}
+
+	return v.Sections, nil
+}
+
+// ParseBytes will parse the given bytes and return the parsed sections.
+func ParseBytes(b []byte) (Sections, error) {
+	tree, err := ParseASTBytes(b)
+	if err != nil {
+		return Sections{}, err
+	}
+
+	v := NewDefaultVisitor()
+	if err = Walk(tree, v); err != nil {
+		return Sections{}, err
+	}
+
+	return v.Sections, nil
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/ini_lexer.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/ini_lexer.go
new file mode 100644
index 00000000..582c024a
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/ini_lexer.go
@@ -0,0 +1,165 @@
+package ini
+
+import (
+	"bytes"
+	"io"
+	"io/ioutil"
+
+	"github.com/aws/aws-sdk-go/aws/awserr"
+)
+
+const (
+	// ErrCodeUnableToReadFile is used when a file is failed to be
+	// opened or read from.
+	ErrCodeUnableToReadFile = "FailedRead"
+)
+
+// TokenType represents the various different tokens types
+type TokenType int
+
+func (t TokenType) String() string {
+	switch t {
+	case TokenNone:
+		return "none"
+	case TokenLit:
+		return "literal"
+	case TokenSep:
+		return "sep"
+	case TokenOp:
+		return "op"
+	case TokenWS:
+		return "ws"
+	case TokenNL:
+		return "newline"
+	case TokenComment:
+		return "comment"
+	case TokenComma:
+		return "comma"
+	default:
+		return ""
+	}
+}
+
+// TokenType enums
+const (
+	TokenNone = TokenType(iota)
+	TokenLit
+	TokenSep
+	TokenComma
+	TokenOp
+	TokenWS
+	TokenNL
+	TokenComment
+)
+
+type iniLexer struct{}
+
+// Tokenize will return a list of tokens during lexical analysis of the
+// io.Reader.
+func (l *iniLexer) Tokenize(r io.Reader) ([]Token, error) {
+	b, err := ioutil.ReadAll(r)
+	if err != nil {
+		return nil, awserr.New(ErrCodeUnableToReadFile, "unable to read file", err)
+	}
+
+	return l.tokenize(b)
+}
+
+func (l *iniLexer) tokenize(b []byte) ([]Token, error) {
+	runes := bytes.Runes(b)
+	var err error
+	n := 0
+	tokenAmount := countTokens(runes)
+	tokens := make([]Token, tokenAmount)
+	count := 0
+
+	for len(runes) > 0 && count < tokenAmount {
+		switch {
+		case isWhitespace(runes[0]):
+			tokens[count], n, err = newWSToken(runes)
+		case isComma(runes[0]):
+			tokens[count], n = newCommaToken(), 1
+		case isComment(runes):
+			tokens[count], n, err = newCommentToken(runes)
+		case isNewline(runes):
+			tokens[count], n, err = newNewlineToken(runes)
+		case isSep(runes):
+			tokens[count], n, err = newSepToken(runes)
+		case isOp(runes):
+			tokens[count], n, err = newOpToken(runes)
+		default:
+			tokens[count], n, err = newLitToken(runes)
+		}
+
+		if err != nil {
+			return nil, err
+		}
+
+		count++
+
+		runes = runes[n:]
+	}
+
+	return tokens[:count], nil
+}
+
+func countTokens(runes []rune) int {
+	count, n := 0, 0
+	var err error
+
+	for len(runes) > 0 {
+		switch {
+		case isWhitespace(runes[0]):
+			_, n, err = newWSToken(runes)
+		case isComma(runes[0]):
+			_, n = newCommaToken(), 1
+		case isComment(runes):
+			_, n, err = newCommentToken(runes)
+		case isNewline(runes):
+			_, n, err = newNewlineToken(runes)
+		case isSep(runes):
+			_, n, err = newSepToken(runes)
+		case isOp(runes):
+			_, n, err = newOpToken(runes)
+		default:
+			_, n, err = newLitToken(runes)
+		}
+
+		if err != nil {
+			return 0
+		}
+
+		count++
+		runes = runes[n:]
+	}
+
+	return count + 1
+}
+
+// Token indicates a metadata about a given value.
+type Token struct {
+	t         TokenType
+	ValueType ValueType
+	base      int
+	raw       []rune
+}
+
+var emptyValue = Value{}
+
+func newToken(t TokenType, raw []rune, v ValueType) Token {
+	return Token{
+		t:         t,
+		raw:       raw,
+		ValueType: v,
+	}
+}
+
+// Raw return the raw runes that were consumed
+func (tok Token) Raw() []rune {
+	return tok.raw
+}
+
+// Type returns the token type
+func (tok Token) Type() TokenType {
+	return tok.t
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/ini_parser.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/ini_parser.go
new file mode 100644
index 00000000..f9970337
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/ini_parser.go
@@ -0,0 +1,347 @@
+package ini
+
+import (
+	"fmt"
+	"io"
+)
+
+// State enums for the parse table
+const (
+	InvalidState = iota
+	// stmt -> value stmt'
+	StatementState
+	// stmt' -> MarkComplete | op stmt
+	StatementPrimeState
+	// value -> number | string | boolean | quoted_string
+	ValueState
+	// section -> [ section'
+	OpenScopeState
+	// section' -> value section_close
+	SectionState
+	// section_close -> ]
+	CloseScopeState
+	// SkipState will skip (NL WS)+
+	SkipState
+	// SkipTokenState will skip any token and push the previous
+	// state onto the stack.
+	SkipTokenState
+	// comment -> # comment' | ; comment'
+	// comment' -> MarkComplete | value
+	CommentState
+	// MarkComplete state will complete statements and move that
+	// to the completed AST list
+	MarkCompleteState
+	// TerminalState signifies that the tokens have been fully parsed
+	TerminalState
+)
+
+// parseTable is a state machine to dictate the grammar above.
+var parseTable = map[ASTKind]map[TokenType]int{
+	ASTKindStart: map[TokenType]int{
+		TokenLit:     StatementState,
+		TokenSep:     OpenScopeState,
+		TokenWS:      SkipTokenState,
+		TokenNL:      SkipTokenState,
+		TokenComment: CommentState,
+		TokenNone:    TerminalState,
+	},
+	ASTKindCommentStatement: map[TokenType]int{
+		TokenLit:     StatementState,
+		TokenSep:     OpenScopeState,
+		TokenWS:      SkipTokenState,
+		TokenNL:      SkipTokenState,
+		TokenComment: CommentState,
+		TokenNone:    MarkCompleteState,
+	},
+	ASTKindExpr: map[TokenType]int{
+		TokenOp:      StatementPrimeState,
+		TokenLit:     ValueState,
+		TokenSep:     OpenScopeState,
+		TokenWS:      ValueState,
+		TokenNL:      SkipState,
+		TokenComment: CommentState,
+		TokenNone:    MarkCompleteState,
+	},
+	ASTKindEqualExpr: map[TokenType]int{
+		TokenLit: ValueState,
+		TokenWS:  SkipTokenState,
+		TokenNL:  SkipState,
+	},
+	ASTKindStatement: map[TokenType]int{
+		TokenLit:     SectionState,
+		TokenSep:     CloseScopeState,
+		TokenWS:      SkipTokenState,
+		TokenNL:      SkipTokenState,
+		TokenComment: CommentState,
+		TokenNone:    MarkCompleteState,
+	},
+	ASTKindExprStatement: map[TokenType]int{
+		TokenLit:     ValueState,
+		TokenSep:     OpenScopeState,
+		TokenOp:      ValueState,
+		TokenWS:      ValueState,
+		TokenNL:      MarkCompleteState,
+		TokenComment: CommentState,
+		TokenNone:    TerminalState,
+		TokenComma:   SkipState,
+	},
+	ASTKindSectionStatement: map[TokenType]int{
+		TokenLit: SectionState,
+		TokenOp:  SectionState,
+		TokenSep: CloseScopeState,
+		TokenWS:  SectionState,
+		TokenNL:  SkipTokenState,
+	},
+	ASTKindCompletedSectionStatement: map[TokenType]int{
+		TokenWS:      SkipTokenState,
+		TokenNL:      SkipTokenState,
+		TokenLit:     StatementState,
+		TokenSep:     OpenScopeState,
+		TokenComment: CommentState,
+		TokenNone:    MarkCompleteState,
+	},
+	ASTKindSkipStatement: map[TokenType]int{
+		TokenLit:     StatementState,
+		TokenSep:     OpenScopeState,
+		TokenWS:      SkipTokenState,
+		TokenNL:      SkipTokenState,
+		TokenComment: CommentState,
+		TokenNone:    TerminalState,
+	},
+}
+
+// ParseAST will parse input from an io.Reader using
+// an LL(1) parser.
+func ParseAST(r io.Reader) ([]AST, error) {
+	lexer := iniLexer{}
+	tokens, err := lexer.Tokenize(r)
+	if err != nil {
+		return []AST{}, err
+	}
+
+	return parse(tokens)
+}
+
+// ParseASTBytes will parse input from a byte slice using
+// an LL(1) parser.
+func ParseASTBytes(b []byte) ([]AST, error) {
+	lexer := iniLexer{}
+	tokens, err := lexer.tokenize(b)
+	if err != nil {
+		return []AST{}, err
+	}
+
+	return parse(tokens)
+}
+
+func parse(tokens []Token) ([]AST, error) {
+	start := Start
+	stack := newParseStack(3, len(tokens))
+
+	stack.Push(start)
+	s := newSkipper()
+
+loop:
+	for stack.Len() > 0 {
+		k := stack.Pop()
+
+		var tok Token
+		if len(tokens) == 0 {
+			// this occurs when all the tokens have been processed
+			// but reduction of what's left on the stack needs to
+			// occur.
+			tok = emptyToken
+		} else {
+			tok = tokens[0]
+		}
+
+		step := parseTable[k.Kind][tok.Type()]
+		if s.ShouldSkip(tok) {
+			// being in a skip state with no tokens will break out of
+			// the parse loop since there is nothing left to process.
+			if len(tokens) == 0 {
+				break loop
+			}
+
+			step = SkipTokenState
+		}
+
+		switch step {
+		case TerminalState:
+			// Finished parsing. Push what should be the last
+			// statement to the stack. If there is anything left
+			// on the stack, an error in parsing has occurred.
+			if k.Kind != ASTKindStart {
+				stack.MarkComplete(k)
+			}
+			break loop
+		case SkipTokenState:
+			// When skipping a token, the previous state was popped off the stack.
+			// To maintain the correct state, the previous state will be pushed
+			// onto the stack.
+			stack.Push(k)
+		case StatementState:
+			if k.Kind != ASTKindStart {
+				stack.MarkComplete(k)
+			}
+			expr := newExpression(tok)
+			stack.Push(expr)
+		case StatementPrimeState:
+			if tok.Type() != TokenOp {
+				stack.MarkComplete(k)
+				continue
+			}
+
+			if k.Kind != ASTKindExpr {
+				return nil, NewParseError(
+					fmt.Sprintf("invalid expression: expected Expr type, but found %T type", k),
+				)
+			}
+
+			k = trimSpaces(k)
+			expr := newEqualExpr(k, tok)
+			stack.Push(expr)
+		case ValueState:
+			// ValueState requires the previous state to either be an equal expression
+			// or an expression statement.
+			//
+			// This grammar occurs when the RHS is a number, word, or quoted string.
+			// equal_expr -> lit op equal_expr'
+			// equal_expr' -> number | string | quoted_string
+			// quoted_string -> " quoted_string'
+			// quoted_string' -> string quoted_string_end
+			// quoted_string_end -> "
+			//
+			// otherwise
+			// expr_stmt -> equal_expr (expr_stmt')*
+			// expr_stmt' -> ws S | op S | MarkComplete
+			// S -> equal_expr' expr_stmt'
+			switch k.Kind {
+			case ASTKindEqualExpr:
+				// assiging a value to some key
+				k.AppendChild(newExpression(tok))
+				stack.Push(newExprStatement(k))
+			case ASTKindExpr:
+				k.Root.raw = append(k.Root.raw, tok.Raw()...)
+				stack.Push(k)
+			case ASTKindExprStatement:
+				root := k.GetRoot()
+				children := root.GetChildren()
+				if len(children) == 0 {
+					return nil, NewParseError(
+						fmt.Sprintf("invalid expression: AST contains no children %s", k.Kind),
+					)
+				}
+
+				rhs := children[len(children)-1]
+
+				if rhs.Root.ValueType != QuotedStringType {
+					rhs.Root.ValueType = StringType
+					rhs.Root.raw = append(rhs.Root.raw, tok.Raw()...)
+
+				}
+
+				children[len(children)-1] = rhs
+				k.SetChildren(children)
+
+				stack.Push(k)
+			}
+		case OpenScopeState:
+			if !runeCompare(tok.Raw(), openBrace) {
+				return nil, NewParseError("expected '['")
+			}
+
+			stmt := newStatement()
+			stack.Push(stmt)
+		case CloseScopeState:
+			if !runeCompare(tok.Raw(), closeBrace) {
+				return nil, NewParseError("expected ']'")
+			}
+
+			k = trimSpaces(k)
+			stack.Push(newCompletedSectionStatement(k))
+		case SectionState:
+			var stmt AST
+
+			switch k.Kind {
+			case ASTKindStatement:
+				// If there are multiple literals inside of a scope declaration,
+				// then the current token's raw value will be appended to the Name.
+				//
+				// This handles cases like [ profile default ]
+				//
+				// k will represent a SectionStatement with the children representing
+				// the label of the section
+				stmt = newSectionStatement(tok)
+			case ASTKindSectionStatement:
+				k.Root.raw = append(k.Root.raw, tok.Raw()...)
+				stmt = k
+			default:
+				return nil, NewParseError(
+					fmt.Sprintf("invalid statement: expected statement: %v", k.Kind),
+				)
+			}
+
+			stack.Push(stmt)
+		case MarkCompleteState:
+			if k.Kind != ASTKindStart {
+				stack.MarkComplete(k)
+			}
+
+			if stack.Len() == 0 {
+				stack.Push(start)
+			}
+		case SkipState:
+			stack.Push(newSkipStatement(k))
+			s.Skip()
+		case CommentState:
+			if k.Kind == ASTKindStart {
+				stack.Push(k)
+			} else {
+				stack.MarkComplete(k)
+			}
+
+			stmt := newCommentStatement(tok)
+			stack.Push(stmt)
+		default:
+			return nil, NewParseError(fmt.Sprintf("invalid state with ASTKind %v and TokenType %v", k, tok))
+		}
+
+		if len(tokens) > 0 {
+			tokens = tokens[1:]
+		}
+	}
+
+	// this occurs when a statement has not been completed
+	if stack.top > 1 {
+		return nil, NewParseError(fmt.Sprintf("incomplete expression: %v", stack.container))
+	}
+
+	// returns a sublist which excludes the start symbol
+	return stack.List(), nil
+}
+
+// trimSpaces will trim spaces on the left and right hand side of
+// the literal.
+func trimSpaces(k AST) AST {
+	// trim left hand side of spaces
+	for i := 0; i < len(k.Root.raw); i++ {
+		if !isWhitespace(k.Root.raw[i]) {
+			break
+		}
+
+		k.Root.raw = k.Root.raw[1:]
+		i--
+	}
+
+	// trim right hand side of spaces
+	for i := len(k.Root.raw) - 1; i >= 0; i-- {
+		if !isWhitespace(k.Root.raw[i]) {
+			break
+		}
+
+		k.Root.raw = k.Root.raw[:len(k.Root.raw)-1]
+	}
+
+	return k
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/literal_tokens.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/literal_tokens.go
new file mode 100644
index 00000000..24df543d
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/literal_tokens.go
@@ -0,0 +1,324 @@
+package ini
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+var (
+	runesTrue  = []rune("true")
+	runesFalse = []rune("false")
+)
+
+var literalValues = [][]rune{
+	runesTrue,
+	runesFalse,
+}
+
+func isBoolValue(b []rune) bool {
+	for _, lv := range literalValues {
+		if isLitValue(lv, b) {
+			return true
+		}
+	}
+	return false
+}
+
+func isLitValue(want, have []rune) bool {
+	if len(have) < len(want) {
+		return false
+	}
+
+	for i := 0; i < len(want); i++ {
+		if want[i] != have[i] {
+			return false
+		}
+	}
+
+	return true
+}
+
+// isNumberValue will return whether not the leading characters in
+// a byte slice is a number. A number is delimited by whitespace or
+// the newline token.
+//
+// A number is defined to be in a binary, octal, decimal (int | float), hex format,
+// or in scientific notation.
+func isNumberValue(b []rune) bool {
+	negativeIndex := 0
+	helper := numberHelper{}
+	needDigit := false
+
+	for i := 0; i < len(b); i++ {
+		negativeIndex++
+
+		switch b[i] {
+		case '-':
+			if helper.IsNegative() || negativeIndex != 1 {
+				return false
+			}
+			helper.Determine(b[i])
+			needDigit = true
+			continue
+		case 'e', 'E':
+			if err := helper.Determine(b[i]); err != nil {
+				return false
+			}
+			negativeIndex = 0
+			needDigit = true
+			continue
+		case 'b':
+			if helper.numberFormat == hex {
+				break
+			}
+			fallthrough
+		case 'o', 'x':
+			needDigit = true
+			if i == 0 {
+				return false
+			}
+
+			fallthrough
+		case '.':
+			if err := helper.Determine(b[i]); err != nil {
+				return false
+			}
+			needDigit = true
+			continue
+		}
+
+		if i > 0 && (isNewline(b[i:]) || isWhitespace(b[i])) {
+			return !needDigit
+		}
+
+		if !helper.CorrectByte(b[i]) {
+			return false
+		}
+		needDigit = false
+	}
+
+	return !needDigit
+}
+
+func isValid(b []rune) (bool, int, error) {
+	if len(b) == 0 {
+		// TODO: should probably return an error
+		return false, 0, nil
+	}
+
+	return isValidRune(b[0]), 1, nil
+}
+
+func isValidRune(r rune) bool {
+	return r != ':' && r != '=' && r != '[' && r != ']' && r != ' ' && r != '\n'
+}
+
+// ValueType is an enum that will signify what type
+// the Value is
+type ValueType int
+
+func (v ValueType) String() string {
+	switch v {
+	case NoneType:
+		return "NONE"
+	case DecimalType:
+		return "FLOAT"
+	case IntegerType:
+		return "INT"
+	case StringType:
+		return "STRING"
+	case BoolType:
+		return "BOOL"
+	}
+
+	return ""
+}
+
+// ValueType enums
+const (
+	NoneType = ValueType(iota)
+	DecimalType
+	IntegerType
+	StringType
+	QuotedStringType
+	BoolType
+)
+
+// Value is a union container
+type Value struct {
+	Type ValueType
+	raw  []rune
+
+	integer int64
+	decimal float64
+	boolean bool
+	str     string
+}
+
+func newValue(t ValueType, base int, raw []rune) (Value, error) {
+	v := Value{
+		Type: t,
+		raw:  raw,
+	}
+	var err error
+
+	switch t {
+	case DecimalType:
+		v.decimal, err = strconv.ParseFloat(string(raw), 64)
+	case IntegerType:
+		if base != 10 {
+			raw = raw[2:]
+		}
+
+		v.integer, err = strconv.ParseInt(string(raw), base, 64)
+	case StringType:
+		v.str = string(raw)
+	case QuotedStringType:
+		v.str = string(raw[1 : len(raw)-1])
+	case BoolType:
+		v.boolean = runeCompare(v.raw, runesTrue)
+	}
+
+	// issue 2253
+	//
+	// if the value trying to be parsed is too large, then we will use
+	// the 'StringType' and raw value instead.
+	if nerr, ok := err.(*strconv.NumError); ok && nerr.Err == strconv.ErrRange {
+		v.Type = StringType
+		v.str = string(raw)
+		err = nil
+	}
+
+	return v, err
+}
+
+// Append will append values and change the type to a string
+// type.
+func (v *Value) Append(tok Token) {
+	r := tok.Raw()
+	if v.Type != QuotedStringType {
+		v.Type = StringType
+		r = tok.raw[1 : len(tok.raw)-1]
+	}
+	if tok.Type() != TokenLit {
+		v.raw = append(v.raw, tok.Raw()...)
+	} else {
+		v.raw = append(v.raw, r...)
+	}
+}
+
+func (v Value) String() string {
+	switch v.Type {
+	case DecimalType:
+		return fmt.Sprintf("decimal: %f", v.decimal)
+	case IntegerType:
+		return fmt.Sprintf("integer: %d", v.integer)
+	case StringType:
+		return fmt.Sprintf("string: %s", string(v.raw))
+	case QuotedStringType:
+		return fmt.Sprintf("quoted string: %s", string(v.raw))
+	case BoolType:
+		return fmt.Sprintf("bool: %t", v.boolean)
+	default:
+		return "union not set"
+	}
+}
+
+func newLitToken(b []rune) (Token, int, error) {
+	n := 0
+	var err error
+
+	token := Token{}
+	if b[0] == '"' {
+		n, err = getStringValue(b)
+		if err != nil {
+			return token, n, err
+		}
+
+		token = newToken(TokenLit, b[:n], QuotedStringType)
+	} else if isNumberValue(b) {
+		var base int
+		base, n, err = getNumericalValue(b)
+		if err != nil {
+			return token, 0, err
+		}
+
+		value := b[:n]
+		vType := IntegerType
+		if contains(value, '.') || hasExponent(value) {
+			vType = DecimalType
+		}
+		token = newToken(TokenLit, value, vType)
+		token.base = base
+	} else if isBoolValue(b) {
+		n, err = getBoolValue(b)
+
+		token = newToken(TokenLit, b[:n], BoolType)
+	} else {
+		n, err = getValue(b)
+		token = newToken(TokenLit, b[:n], StringType)
+	}
+
+	return token, n, err
+}
+
+// IntValue returns an integer value
+func (v Value) IntValue() int64 {
+	return v.integer
+}
+
+// FloatValue returns a float value
+func (v Value) FloatValue() float64 {
+	return v.decimal
+}
+
+// BoolValue returns a bool value
+func (v Value) BoolValue() bool {
+	return v.boolean
+}
+
+func isTrimmable(r rune) bool {
+	switch r {
+	case '\n', ' ':
+		return true
+	}
+	return false
+}
+
+// StringValue returns the string value
+func (v Value) StringValue() string {
+	switch v.Type {
+	case StringType:
+		return strings.TrimFunc(string(v.raw), isTrimmable)
+	case QuotedStringType:
+		// preserve all characters in the quotes
+		return string(removeEscapedCharacters(v.raw[1 : len(v.raw)-1]))
+	default:
+		return strings.TrimFunc(string(v.raw), isTrimmable)
+	}
+}
+
+func contains(runes []rune, c rune) bool {
+	for i := 0; i < len(runes); i++ {
+		if runes[i] == c {
+			return true
+		}
+	}
+
+	return false
+}
+
+func runeCompare(v1 []rune, v2 []rune) bool {
+	if len(v1) != len(v2) {
+		return false
+	}
+
+	for i := 0; i < len(v1); i++ {
+		if v1[i] != v2[i] {
+			return false
+		}
+	}
+
+	return true
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/newline_token.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/newline_token.go
new file mode 100644
index 00000000..e52ac399
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/newline_token.go
@@ -0,0 +1,30 @@
+package ini
+
+func isNewline(b []rune) bool {
+	if len(b) == 0 {
+		return false
+	}
+
+	if b[0] == '\n' {
+		return true
+	}
+
+	if len(b) < 2 {
+		return false
+	}
+
+	return b[0] == '\r' && b[1] == '\n'
+}
+
+func newNewlineToken(b []rune) (Token, int, error) {
+	i := 1
+	if b[0] == '\r' && isNewline(b[1:]) {
+		i++
+	}
+
+	if !isNewline([]rune(b[:i])) {
+		return emptyToken, 0, NewParseError("invalid new line token")
+	}
+
+	return newToken(TokenNL, b[:i], NoneType), i, nil
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/number_helper.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/number_helper.go
new file mode 100644
index 00000000..a45c0bc5
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/number_helper.go
@@ -0,0 +1,152 @@
+package ini
+
+import (
+	"bytes"
+	"fmt"
+	"strconv"
+)
+
+const (
+	none = numberFormat(iota)
+	binary
+	octal
+	decimal
+	hex
+	exponent
+)
+
+type numberFormat int
+
+// numberHelper is used to dictate what format a number is in
+// and what to do for negative values. Since -1e-4 is a valid
+// number, we cannot just simply check for duplicate negatives.
+type numberHelper struct {
+	numberFormat numberFormat
+
+	negative         bool
+	negativeExponent bool
+}
+
+func (b numberHelper) Exists() bool {
+	return b.numberFormat != none
+}
+
+func (b numberHelper) IsNegative() bool {
+	return b.negative || b.negativeExponent
+}
+
+func (b *numberHelper) Determine(c rune) error {
+	if b.Exists() {
+		return NewParseError(fmt.Sprintf("multiple number formats: 0%v", string(c)))
+	}
+
+	switch c {
+	case 'b':
+		b.numberFormat = binary
+	case 'o':
+		b.numberFormat = octal
+	case 'x':
+		b.numberFormat = hex
+	case 'e', 'E':
+		b.numberFormat = exponent
+	case '-':
+		if b.numberFormat != exponent {
+			b.negative = true
+		} else {
+			b.negativeExponent = true
+		}
+	case '.':
+		b.numberFormat = decimal
+	default:
+		return NewParseError(fmt.Sprintf("invalid number character: %v", string(c)))
+	}
+
+	return nil
+}
+
+func (b numberHelper) CorrectByte(c rune) bool {
+	switch {
+	case b.numberFormat == binary:
+		if !isBinaryByte(c) {
+			return false
+		}
+	case b.numberFormat == octal:
+		if !isOctalByte(c) {
+			return false
+		}
+	case b.numberFormat == hex:
+		if !isHexByte(c) {
+			return false
+		}
+	case b.numberFormat == decimal:
+		if !isDigit(c) {
+			return false
+		}
+	case b.numberFormat == exponent:
+		if !isDigit(c) {
+			return false
+		}
+	case b.negativeExponent:
+		if !isDigit(c) {
+			return false
+		}
+	case b.negative:
+		if !isDigit(c) {
+			return false
+		}
+	default:
+		if !isDigit(c) {
+			return false
+		}
+	}
+
+	return true
+}
+
+func (b numberHelper) Base() int {
+	switch b.numberFormat {
+	case binary:
+		return 2
+	case octal:
+		return 8
+	case hex:
+		return 16
+	default:
+		return 10
+	}
+}
+
+func (b numberHelper) String() string {
+	buf := bytes.Buffer{}
+	i := 0
+
+	switch b.numberFormat {
+	case binary:
+		i++
+		buf.WriteString(strconv.Itoa(i) + ": binary format\n")
+	case octal:
+		i++
+		buf.WriteString(strconv.Itoa(i) + ": octal format\n")
+	case hex:
+		i++
+		buf.WriteString(strconv.Itoa(i) + ": hex format\n")
+	case exponent:
+		i++
+		buf.WriteString(strconv.Itoa(i) + ": exponent format\n")
+	default:
+		i++
+		buf.WriteString(strconv.Itoa(i) + ": integer format\n")
+	}
+
+	if b.negative {
+		i++
+		buf.WriteString(strconv.Itoa(i) + ": negative format\n")
+	}
+
+	if b.negativeExponent {
+		i++
+		buf.WriteString(strconv.Itoa(i) + ": negative exponent format\n")
+	}
+
+	return buf.String()
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/op_tokens.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/op_tokens.go
new file mode 100644
index 00000000..8a84c7cb
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/op_tokens.go
@@ -0,0 +1,39 @@
+package ini
+
+import (
+	"fmt"
+)
+
+var (
+	equalOp      = []rune("=")
+	equalColonOp = []rune(":")
+)
+
+func isOp(b []rune) bool {
+	if len(b) == 0 {
+		return false
+	}
+
+	switch b[0] {
+	case '=':
+		return true
+	case ':':
+		return true
+	default:
+		return false
+	}
+}
+
+func newOpToken(b []rune) (Token, int, error) {
+	tok := Token{}
+
+	switch b[0] {
+	case '=':
+		tok = newToken(TokenOp, equalOp, NoneType)
+	case ':':
+		tok = newToken(TokenOp, equalColonOp, NoneType)
+	default:
+		return tok, 0, NewParseError(fmt.Sprintf("unexpected op type, %v", b[0]))
+	}
+	return tok, 1, nil
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/parse_error.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/parse_error.go
new file mode 100644
index 00000000..45728701
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/parse_error.go
@@ -0,0 +1,43 @@
+package ini
+
+import "fmt"
+
+const (
+	// ErrCodeParseError is returned when a parsing error
+	// has occurred.
+	ErrCodeParseError = "INIParseError"
+)
+
+// ParseError is an error which is returned during any part of
+// the parsing process.
+type ParseError struct {
+	msg string
+}
+
+// NewParseError will return a new ParseError where message
+// is the description of the error.
+func NewParseError(message string) *ParseError {
+	return &ParseError{
+		msg: message,
+	}
+}
+
+// Code will return the ErrCodeParseError
+func (err *ParseError) Code() string {
+	return ErrCodeParseError
+}
+
+// Message returns the error's message
+func (err *ParseError) Message() string {
+	return err.msg
+}
+
+// OrigError return nothing since there will never be any
+// original error.
+func (err *ParseError) OrigError() error {
+	return nil
+}
+
+func (err *ParseError) Error() string {
+	return fmt.Sprintf("%s: %s", err.Code(), err.Message())
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/parse_stack.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/parse_stack.go
new file mode 100644
index 00000000..7f01cf7c
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/parse_stack.go
@@ -0,0 +1,60 @@
+package ini
+
+import (
+	"bytes"
+	"fmt"
+)
+
+// ParseStack is a stack that contains a container, the stack portion,
+// and the list which is the list of ASTs that have been successfully
+// parsed.
+type ParseStack struct {
+	top       int
+	container []AST
+	list      []AST
+	index     int
+}
+
+func newParseStack(sizeContainer, sizeList int) ParseStack {
+	return ParseStack{
+		container: make([]AST, sizeContainer),
+		list:      make([]AST, sizeList),
+	}
+}
+
+// Pop will return and truncate the last container element.
+func (s *ParseStack) Pop() AST {
+	s.top--
+	return s.container[s.top]
+}
+
+// Push will add the new AST to the container
+func (s *ParseStack) Push(ast AST) {
+	s.container[s.top] = ast
+	s.top++
+}
+
+// MarkComplete will append the AST to the list of completed statements
+func (s *ParseStack) MarkComplete(ast AST) {
+	s.list[s.index] = ast
+	s.index++
+}
+
+// List will return the completed statements
+func (s ParseStack) List() []AST {
+	return s.list[:s.index]
+}
+
+// Len will return the length of the container
+func (s *ParseStack) Len() int {
+	return s.top
+}
+
+func (s ParseStack) String() string {
+	buf := bytes.Buffer{}
+	for i, node := range s.list {
+		buf.WriteString(fmt.Sprintf("%d: %v\n", i+1, node))
+	}
+
+	return buf.String()
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/sep_tokens.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/sep_tokens.go
new file mode 100644
index 00000000..f82095ba
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/sep_tokens.go
@@ -0,0 +1,41 @@
+package ini
+
+import (
+	"fmt"
+)
+
+var (
+	emptyRunes = []rune{}
+)
+
+func isSep(b []rune) bool {
+	if len(b) == 0 {
+		return false
+	}
+
+	switch b[0] {
+	case '[', ']':
+		return true
+	default:
+		return false
+	}
+}
+
+var (
+	openBrace  = []rune("[")
+	closeBrace = []rune("]")
+)
+
+func newSepToken(b []rune) (Token, int, error) {
+	tok := Token{}
+
+	switch b[0] {
+	case '[':
+		tok = newToken(TokenSep, openBrace, NoneType)
+	case ']':
+		tok = newToken(TokenSep, closeBrace, NoneType)
+	default:
+		return tok, 0, NewParseError(fmt.Sprintf("unexpected sep type, %v", b[0]))
+	}
+	return tok, 1, nil
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/skipper.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/skipper.go
new file mode 100644
index 00000000..6bb69644
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/skipper.go
@@ -0,0 +1,45 @@
+package ini
+
+// skipper is used to skip certain blocks of an ini file.
+// Currently skipper is used to skip nested blocks of ini
+// files. See example below
+//
+//	[ foo ]
+//	nested = ; this section will be skipped
+//		a=b
+//		c=d
+//	bar=baz ; this will be included
+type skipper struct {
+	shouldSkip bool
+	TokenSet   bool
+	prevTok    Token
+}
+
+func newSkipper() skipper {
+	return skipper{
+		prevTok: emptyToken,
+	}
+}
+
+func (s *skipper) ShouldSkip(tok Token) bool {
+	if s.shouldSkip &&
+		s.prevTok.Type() == TokenNL &&
+		tok.Type() != TokenWS {
+
+		s.Continue()
+		return false
+	}
+	s.prevTok = tok
+
+	return s.shouldSkip
+}
+
+func (s *skipper) Skip() {
+	s.shouldSkip = true
+	s.prevTok = emptyToken
+}
+
+func (s *skipper) Continue() {
+	s.shouldSkip = false
+	s.prevTok = emptyToken
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/statement.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/statement.go
new file mode 100644
index 00000000..18f3fe89
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/statement.go
@@ -0,0 +1,35 @@
+package ini
+
+// Statement is an empty AST mostly used for transitioning states.
+func newStatement() AST {
+	return newAST(ASTKindStatement, AST{})
+}
+
+// SectionStatement represents a section AST
+func newSectionStatement(tok Token) AST {
+	return newASTWithRootToken(ASTKindSectionStatement, tok)
+}
+
+// ExprStatement represents a completed expression AST
+func newExprStatement(ast AST) AST {
+	return newAST(ASTKindExprStatement, ast)
+}
+
+// CommentStatement represents a comment in the ini definition.
+//
+//	grammar:
+//	comment -> #comment' | ;comment'
+//	comment' -> epsilon | value
+func newCommentStatement(tok Token) AST {
+	return newAST(ASTKindCommentStatement, newExpression(tok))
+}
+
+// CompletedSectionStatement represents a completed section
+func newCompletedSectionStatement(ast AST) AST {
+	return newAST(ASTKindCompletedSectionStatement, ast)
+}
+
+// SkipStatement is used to skip whole statements
+func newSkipStatement(ast AST) AST {
+	return newAST(ASTKindSkipStatement, ast)
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/value_util.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/value_util.go
new file mode 100644
index 00000000..305999d2
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/value_util.go
@@ -0,0 +1,284 @@
+package ini
+
+import (
+	"fmt"
+)
+
+// getStringValue will return a quoted string and the amount
+// of bytes read
+//
+// an error will be returned if the string is not properly formatted
+func getStringValue(b []rune) (int, error) {
+	if b[0] != '"' {
+		return 0, NewParseError("strings must start with '\"'")
+	}
+
+	endQuote := false
+	i := 1
+
+	for ; i < len(b) && !endQuote; i++ {
+		if escaped := isEscaped(b[:i], b[i]); b[i] == '"' && !escaped {
+			endQuote = true
+			break
+		} else if escaped {
+			/*c, err := getEscapedByte(b[i])
+			if err != nil {
+				return 0, err
+			}
+
+			b[i-1] = c
+			b = append(b[:i], b[i+1:]...)
+			i--*/
+
+			continue
+		}
+	}
+
+	if !endQuote {
+		return 0, NewParseError("missing '\"' in string value")
+	}
+
+	return i + 1, nil
+}
+
+// getBoolValue will return a boolean and the amount
+// of bytes read
+//
+// an error will be returned if the boolean is not of a correct
+// value
+func getBoolValue(b []rune) (int, error) {
+	if len(b) < 4 {
+		return 0, NewParseError("invalid boolean value")
+	}
+
+	n := 0
+	for _, lv := range literalValues {
+		if len(lv) > len(b) {
+			continue
+		}
+
+		if isLitValue(lv, b) {
+			n = len(lv)
+		}
+	}
+
+	if n == 0 {
+		return 0, NewParseError("invalid boolean value")
+	}
+
+	return n, nil
+}
+
+// getNumericalValue will return a numerical string, the amount
+// of bytes read, and the base of the number
+//
+// an error will be returned if the number is not of a correct
+// value
+func getNumericalValue(b []rune) (int, int, error) {
+	if !isDigit(b[0]) {
+		return 0, 0, NewParseError("invalid digit value")
+	}
+
+	i := 0
+	helper := numberHelper{}
+
+loop:
+	for negativeIndex := 0; i < len(b); i++ {
+		negativeIndex++
+
+		if !isDigit(b[i]) {
+			switch b[i] {
+			case '-':
+				if helper.IsNegative() || negativeIndex != 1 {
+					return 0, 0, NewParseError("parse error '-'")
+				}
+
+				n := getNegativeNumber(b[i:])
+				i += (n - 1)
+				helper.Determine(b[i])
+				continue
+			case '.':
+				if err := helper.Determine(b[i]); err != nil {
+					return 0, 0, err
+				}
+			case 'e', 'E':
+				if err := helper.Determine(b[i]); err != nil {
+					return 0, 0, err
+				}
+
+				negativeIndex = 0
+			case 'b':
+				if helper.numberFormat == hex {
+					break
+				}
+				fallthrough
+			case 'o', 'x':
+				if i == 0 && b[i] != '0' {
+					return 0, 0, NewParseError("incorrect base format, expected leading '0'")
+				}
+
+				if i != 1 {
+					return 0, 0, NewParseError(fmt.Sprintf("incorrect base format found %s at %d index", string(b[i]), i))
+				}
+
+				if err := helper.Determine(b[i]); err != nil {
+					return 0, 0, err
+				}
+			default:
+				if isWhitespace(b[i]) {
+					break loop
+				}
+
+				if isNewline(b[i:]) {
+					break loop
+				}
+
+				if !(helper.numberFormat == hex && isHexByte(b[i])) {
+					if i+2 < len(b) && !isNewline(b[i:i+2]) {
+						return 0, 0, NewParseError("invalid numerical character")
+					} else if !isNewline([]rune{b[i]}) {
+						return 0, 0, NewParseError("invalid numerical character")
+					}
+
+					break loop
+				}
+			}
+		}
+	}
+
+	return helper.Base(), i, nil
+}
+
+// isDigit will return whether or not something is an integer
+func isDigit(b rune) bool {
+	return b >= '0' && b <= '9'
+}
+
+func hasExponent(v []rune) bool {
+	return contains(v, 'e') || contains(v, 'E')
+}
+
+func isBinaryByte(b rune) bool {
+	switch b {
+	case '0', '1':
+		return true
+	default:
+		return false
+	}
+}
+
+func isOctalByte(b rune) bool {
+	switch b {
+	case '0', '1', '2', '3', '4', '5', '6', '7':
+		return true
+	default:
+		return false
+	}
+}
+
+func isHexByte(b rune) bool {
+	if isDigit(b) {
+		return true
+	}
+	return (b >= 'A' && b <= 'F') ||
+		(b >= 'a' && b <= 'f')
+}
+
+func getValue(b []rune) (int, error) {
+	i := 0
+
+	for i < len(b) {
+		if isNewline(b[i:]) {
+			break
+		}
+
+		if isOp(b[i:]) {
+			break
+		}
+
+		valid, n, err := isValid(b[i:])
+		if err != nil {
+			return 0, err
+		}
+
+		if !valid {
+			break
+		}
+
+		i += n
+	}
+
+	return i, nil
+}
+
+// getNegativeNumber will return a negative number from a
+// byte slice. This will iterate through all characters until
+// a non-digit has been found.
+func getNegativeNumber(b []rune) int {
+	if b[0] != '-' {
+		return 0
+	}
+
+	i := 1
+	for ; i < len(b); i++ {
+		if !isDigit(b[i]) {
+			return i
+		}
+	}
+
+	return i
+}
+
+// isEscaped will return whether or not the character is an escaped
+// character.
+func isEscaped(value []rune, b rune) bool {
+	if len(value) == 0 {
+		return false
+	}
+
+	switch b {
+	case '\'': // single quote
+	case '"': // quote
+	case 'n': // newline
+	case 't': // tab
+	case '\\': // backslash
+	default:
+		return false
+	}
+
+	return value[len(value)-1] == '\\'
+}
+
+func getEscapedByte(b rune) (rune, error) {
+	switch b {
+	case '\'': // single quote
+		return '\'', nil
+	case '"': // quote
+		return '"', nil
+	case 'n': // newline
+		return '\n', nil
+	case 't': // table
+		return '\t', nil
+	case '\\': // backslash
+		return '\\', nil
+	default:
+		return b, NewParseError(fmt.Sprintf("invalid escaped character %c", b))
+	}
+}
+
+func removeEscapedCharacters(b []rune) []rune {
+	for i := 0; i < len(b); i++ {
+		if isEscaped(b[:i], b[i]) {
+			c, err := getEscapedByte(b[i])
+			if err != nil {
+				return b
+			}
+
+			b[i-1] = c
+			b = append(b[:i], b[i+1:]...)
+			i--
+		}
+	}
+
+	return b
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/visitor.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/visitor.go
new file mode 100644
index 00000000..94841c32
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/visitor.go
@@ -0,0 +1,166 @@
+package ini
+
+import (
+	"fmt"
+	"sort"
+)
+
+// Visitor is an interface used by walkers that will
+// traverse an array of ASTs.
+type Visitor interface {
+	VisitExpr(AST) error
+	VisitStatement(AST) error
+}
+
+// DefaultVisitor is used to visit statements and expressions
+// and ensure that they are both of the correct format.
+// In addition, upon visiting this will build sections and populate
+// the Sections field which can be used to retrieve profile
+// configuration.
+type DefaultVisitor struct {
+	scope    string
+	Sections Sections
+}
+
+// NewDefaultVisitor return a DefaultVisitor
+func NewDefaultVisitor() *DefaultVisitor {
+	return &DefaultVisitor{
+		Sections: Sections{
+			container: map[string]Section{},
+		},
+	}
+}
+
+// VisitExpr visits expressions...
+func (v *DefaultVisitor) VisitExpr(expr AST) error {
+	t := v.Sections.container[v.scope]
+	if t.values == nil {
+		t.values = values{}
+	}
+
+	switch expr.Kind {
+	case ASTKindExprStatement:
+		opExpr := expr.GetRoot()
+		switch opExpr.Kind {
+		case ASTKindEqualExpr:
+			children := opExpr.GetChildren()
+			if len(children) <= 1 {
+				return NewParseError("unexpected token type")
+			}
+
+			rhs := children[1]
+
+			if rhs.Root.Type() != TokenLit {
+				return NewParseError("unexpected token type")
+			}
+
+			key := EqualExprKey(opExpr)
+			v, err := newValue(rhs.Root.ValueType, rhs.Root.base, rhs.Root.Raw())
+			if err != nil {
+				return err
+			}
+
+			t.values[key] = v
+		default:
+			return NewParseError(fmt.Sprintf("unsupported expression %v", expr))
+		}
+	default:
+		return NewParseError(fmt.Sprintf("unsupported expression %v", expr))
+	}
+
+	v.Sections.container[v.scope] = t
+	return nil
+}
+
+// VisitStatement visits statements...
+func (v *DefaultVisitor) VisitStatement(stmt AST) error {
+	switch stmt.Kind {
+	case ASTKindCompletedSectionStatement:
+		child := stmt.GetRoot()
+		if child.Kind != ASTKindSectionStatement {
+			return NewParseError(fmt.Sprintf("unsupported child statement: %T", child))
+		}
+
+		name := string(child.Root.Raw())
+		v.Sections.container[name] = Section{}
+		v.scope = name
+	default:
+		return NewParseError(fmt.Sprintf("unsupported statement: %s", stmt.Kind))
+	}
+
+	return nil
+}
+
+// Sections is a map of Section structures that represent
+// a configuration.
+type Sections struct {
+	container map[string]Section
+}
+
+// GetSection will return section p. If section p does not exist,
+// false will be returned in the second parameter.
+func (t Sections) GetSection(p string) (Section, bool) {
+	v, ok := t.container[p]
+	return v, ok
+}
+
+// values represents a map of union values.
+type values map[string]Value
+
+// List will return a list of all sections that were successfully
+// parsed.
+func (t Sections) List() []string {
+	keys := make([]string, len(t.container))
+	i := 0
+	for k := range t.container {
+		keys[i] = k
+		i++
+	}
+
+	sort.Strings(keys)
+	return keys
+}
+
+// Section contains a name and values. This represent
+// a sectioned entry in a configuration file.
+type Section struct {
+	Name   string
+	values values
+}
+
+// Has will return whether or not an entry exists in a given section
+func (t Section) Has(k string) bool {
+	_, ok := t.values[k]
+	return ok
+}
+
+// ValueType will returned what type the union is set to. If
+// k was not found, the NoneType will be returned.
+func (t Section) ValueType(k string) (ValueType, bool) {
+	v, ok := t.values[k]
+	return v.Type, ok
+}
+
+// Bool returns a bool value at k
+func (t Section) Bool(k string) bool {
+	return t.values[k].BoolValue()
+}
+
+// Int returns an integer value at k
+func (t Section) Int(k string) int64 {
+	return t.values[k].IntValue()
+}
+
+// Float64 returns a float value at k
+func (t Section) Float64(k string) float64 {
+	return t.values[k].FloatValue()
+}
+
+// String returns the string value at k
+func (t Section) String(k string) string {
+	_, ok := t.values[k]
+	if !ok {
+		return ""
+	}
+	return t.values[k].StringValue()
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/walker.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/walker.go
new file mode 100644
index 00000000..99915f7f
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/walker.go
@@ -0,0 +1,25 @@
+package ini
+
+// Walk will traverse the AST using the v, the Visitor.
+func Walk(tree []AST, v Visitor) error {
+	for _, node := range tree {
+		switch node.Kind {
+		case ASTKindExpr,
+			ASTKindExprStatement:
+
+			if err := v.VisitExpr(node); err != nil {
+				return err
+			}
+		case ASTKindStatement,
+			ASTKindCompletedSectionStatement,
+			ASTKindNestedSectionStatement,
+			ASTKindCompletedNestedSectionStatement:
+
+			if err := v.VisitStatement(node); err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/ws_token.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/ws_token.go
new file mode 100644
index 00000000..7ffb4ae0
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/ini/ws_token.go
@@ -0,0 +1,24 @@
+package ini
+
+import (
+	"unicode"
+)
+
+// isWhitespace will return whether or not the character is
+// a whitespace character.
+//
+// Whitespace is defined as a space or tab.
+func isWhitespace(c rune) bool {
+	return unicode.IsSpace(c) && c != '\n' && c != '\r'
+}
+
+func newWSToken(b []rune) (Token, int, error) {
+	i := 0
+	for ; i < len(b); i++ {
+		if !isWhitespace(b[i]) {
+			break
+		}
+	}
+
+	return newToken(TokenWS, b[:i], NoneType), i, nil
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/sdkio/io_go1.6.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/sdkio/io_go1.6.go
new file mode 100644
index 00000000..5aa9137e
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/sdkio/io_go1.6.go
@@ -0,0 +1,10 @@
+// +build !go1.7
+
+package sdkio
+
+// Copy of Go 1.7 io package's Seeker constants.
+const (
+	SeekStart   = 0 // seek relative to the origin of the file
+	SeekCurrent = 1 // seek relative to the current offset
+	SeekEnd     = 2 // seek relative to the end
+)
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/sdkio/io_go1.7.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/sdkio/io_go1.7.go
new file mode 100644
index 00000000..e5f00561
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/sdkio/io_go1.7.go
@@ -0,0 +1,12 @@
+// +build go1.7
+
+package sdkio
+
+import "io"
+
+// Alias for Go 1.7 io package Seeker constants
+const (
+	SeekStart   = io.SeekStart   // seek relative to the origin of the file
+	SeekCurrent = io.SeekCurrent // seek relative to the current offset
+	SeekEnd     = io.SeekEnd     // seek relative to the end
+)
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/sdkrand/locked_source.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/sdkrand/locked_source.go
new file mode 100644
index 00000000..0c9802d8
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/sdkrand/locked_source.go
@@ -0,0 +1,29 @@
+package sdkrand
+
+import (
+	"math/rand"
+	"sync"
+	"time"
+)
+
+// lockedSource is a thread-safe implementation of rand.Source
+type lockedSource struct {
+	lk  sync.Mutex
+	src rand.Source
+}
+
+func (r *lockedSource) Int63() (n int64) {
+	r.lk.Lock()
+	n = r.src.Int63()
+	r.lk.Unlock()
+	return
+}
+
+func (r *lockedSource) Seed(seed int64) {
+	r.lk.Lock()
+	r.src.Seed(seed)
+	r.lk.Unlock()
+}
+
+// SeededRand is a new RNG using a thread safe implementation of rand.Source
+var SeededRand = rand.New(&lockedSource{src: rand.NewSource(time.Now().UnixNano())})
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/sdkuri/path.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/sdkuri/path.go
new file mode 100644
index 00000000..38ea61af
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/sdkuri/path.go
@@ -0,0 +1,23 @@
+package sdkuri
+
+import (
+	"path"
+	"strings"
+)
+
+// PathJoin will join the elements of the path delimited by the "/"
+// character. Similar to path.Join with the exception the trailing "/"
+// character is preserved if present.
+func PathJoin(elems ...string) string {
+	if len(elems) == 0 {
+		return ""
+	}
+
+	hasTrailing := strings.HasSuffix(elems[len(elems)-1], "/")
+	str := path.Join(elems...)
+	if hasTrailing && str != "/" {
+		str += "/"
+	}
+
+	return str
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/shareddefaults/ecs_container.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/shareddefaults/ecs_container.go
new file mode 100644
index 00000000..7da8a49c
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/shareddefaults/ecs_container.go
@@ -0,0 +1,12 @@
+package shareddefaults
+
+const (
+	// ECSCredsProviderEnvVar is an environmental variable key used to
+	// determine which path needs to be hit.
+	ECSCredsProviderEnvVar = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"
+)
+
+// ECSContainerCredentialsURI is the endpoint to retrieve container
+// credentials. This can be overridden to test to ensure the credential process
+// is behaving correctly.
+var ECSContainerCredentialsURI = "http://169.254.170.2"
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/shareddefaults/shared_config.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/shareddefaults/shared_config.go
new file mode 100644
index 00000000..ebcbc2b4
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-sdk-go/internal/shareddefaults/shared_config.go
@@ -0,0 +1,40 @@
+package shareddefaults
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+)
+
+// SharedCredentialsFilename returns the SDK's default file path
+// for the shared credentials file.
+//
+// Builds the shared config file path based on the OS's platform.
+//
+//   - Linux/Unix: $HOME/.aws/credentials
+//   - Windows: %USERPROFILE%\.aws\credentials
+func SharedCredentialsFilename() string {
+	return filepath.Join(UserHomeDir(), ".aws", "credentials")
+}
+
+// SharedConfigFilename returns the SDK's default file path for
+// the shared config file.
+//
+// Builds the shared config file path based on the OS's platform.
+//
+//   - Linux/Unix: $HOME/.aws/config
+//   - Windows: %USERPROFILE%\.aws\config
+func SharedConfigFilename() string {
+	return filepath.Join(UserHomeDir(), ".aws", "config")
+}
+
+// UserHomeDir returns the home directory for the user the process is
+// running under.
+func UserHomeDir() string {
+	if runtime.GOOS == "windows" { // Windows
+		return os.Getenv("USERPROFILE")
+	}
+
+	// *nix
+	return os.Getenv("HOME")
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/CONTRIBUTORS.md b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/CONTRIBUTORS.md
new file mode 100644
index 00000000..39f91bf0
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/CONTRIBUTORS.md
@@ -0,0 +1,8 @@
+# Contributors
+The following people have contributed to the AWS X-Ray SDK for Go's design and/or implementation (alphabetical):
+* Anssi Alaranta
+* Bilal Khan
+* James Bowman
+* Lulu Zhao
+* Raymond Lin
+* Rohit Banga
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/LICENSE b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/LICENSE
new file mode 100644
index 00000000..8dada3ed
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/NOTICE.txt b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/NOTICE.txt
new file mode 100644
index 00000000..3e0ee43d
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/NOTICE.txt
@@ -0,0 +1,2 @@
+AWS X-Ray SDK for Go
+Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/header/header.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/header/header.go
new file mode 100644
index 00000000..7d5f12b5
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/header/header.go
@@ -0,0 +1,134 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package header
+
+import (
+	"bytes"
+	"strings"
+)
+
+const (
+	// RootPrefix is the prefix for
+	// Root attribute in X-Amzn-Trace-Id.
+	RootPrefix = "Root="
+
+	// ParentPrefix is the prefix for
+	// Parent attribute in X-Amzn-Trace-Id.
+	ParentPrefix = "Parent="
+
+	// SampledPrefix is the prefix for
+	// Sampled attribute in X-Amzn-Trace-Id.
+	SampledPrefix = "Sampled="
+
+	// SelfPrefix is the prefix for
+	// Self attribute in X-Amzn-Trace-Id.
+	SelfPrefix = "Self="
+)
+
+// SamplingDecision is a string representation of
+// whether or not the current segment has been sampled.
+type SamplingDecision string
+
+const (
+	// Sampled indicates the current segment has been
+	// sampled and will be sent to the X-Ray daemon.
+	Sampled SamplingDecision = "Sampled=1"
+
+	// NotSampled indicates the current segment has
+	// not been sampled.
+	NotSampled SamplingDecision = "Sampled=0"
+
+	// Requested indicates sampling decision will be
+	// made by the downstream service and propagated
+	// back upstream in the response.
+	Requested SamplingDecision = "Sampled=?"
+
+	// Unknown indicates no sampling decision will be made.
+	Unknown SamplingDecision = ""
+)
+
+func samplingDecision(s string) SamplingDecision {
+	if s == string(Sampled) {
+		return Sampled
+	} else if s == string(NotSampled) {
+		return NotSampled
+	} else if s == string(Requested) {
+		return Requested
+	}
+	return Unknown
+}
+
+// Header is the value of X-Amzn-Trace-Id.
+type Header struct {
+	TraceID          string
+	ParentID         string
+	SamplingDecision SamplingDecision
+
+	AdditionalData map[string]string
+}
+
+// FromString gets individual value for each item in Header struct.
+func FromString(s string) *Header {
+	ret := &Header{
+		SamplingDecision: Unknown,
+		AdditionalData:   make(map[string]string),
+	}
+	parts := strings.Split(s, ";")
+	for i := range parts {
+		p := strings.TrimSpace(parts[i])
+		value, valid := valueFromKeyValuePair(p)
+		if valid {
+			if strings.HasPrefix(p, RootPrefix) {
+				ret.TraceID = value
+			} else if strings.HasPrefix(p, ParentPrefix) {
+				ret.ParentID = value
+			} else if strings.HasPrefix(p, SampledPrefix) {
+				ret.SamplingDecision = samplingDecision(p)
+			} else if !strings.HasPrefix(p, SelfPrefix) {
+				key, valid := keyFromKeyValuePair(p)
+				if valid {
+					ret.AdditionalData[key] = value
+				}
+			}
+		}
+	}
+	return ret
+}
+
+// String returns a string representation for header.
+func (h Header) String() string {
+	var p [][]byte
+	if h.TraceID != "" {
+		p = append(p, []byte(RootPrefix+h.TraceID))
+	}
+	if h.ParentID != "" {
+		p = append(p, []byte(ParentPrefix+h.ParentID))
+	}
+	p = append(p, []byte(h.SamplingDecision))
+	for key := range h.AdditionalData {
+		p = append(p, []byte(key+"="+h.AdditionalData[key]))
+	}
+	return string(bytes.Join(p, []byte(";")))
+}
+
+func keyFromKeyValuePair(s string) (string, bool) {
+	e := strings.Index(s, "=")
+	if -1 != e {
+		return s[:e], true
+	}
+	return "", false
+}
+
+func valueFromKeyValuePair(s string) (string, bool) {
+	e := strings.Index(s, "=")
+	if -1 != e {
+		return s[e+1:], true
+	}
+	return "", false
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/internal/plugins/plugin.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/internal/plugins/plugin.go
new file mode 100644
index 00000000..f19983db
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/internal/plugins/plugin.go
@@ -0,0 +1,40 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package plugins
+
+import (
+	"github.com/aws/aws-sdk-go/aws/ec2metadata"
+)
+
+// InstancePluginMetadata points to the PluginMetadata struct.
+var InstancePluginMetadata = &PluginMetadata{}
+
+// PluginMetadata struct contains items to record information
+// about the AWS infrastructure hosting the traced application.
+type PluginMetadata struct {
+
+	// IdentityDocument records the shape for unmarshaling an
+	// EC2 instance identity document.
+	IdentityDocument *ec2metadata.EC2InstanceIdentityDocument
+
+	// BeanstalkMetadata records the Elastic Beanstalk
+	// environment name, version label, and deployment ID.
+	BeanstalkMetadata *BeanstalkMetadata
+
+	// ECSContainerName records the ECS container ID.
+	ECSContainerName string
+}
+
+// BeanstalkMetadata provides the shape for unmarshaling
+// Elastic Beanstalk environment metadata.
+type BeanstalkMetadata struct {
+	Environment  string `json:"environment_name"`
+	VersionLabel string `json:"version_label"`
+	DeploymentID int    `json:"deployment_id"`
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/pattern/search_pattern.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/pattern/search_pattern.go
new file mode 100644
index 00000000..aab1aa9d
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/pattern/search_pattern.go
@@ -0,0 +1,97 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+// Package pattern provides a basic pattern matching utility.
+// Patterns may contain fixed text, and/or special characters (`*`, `?`).
+// `*` represents 0 or more wildcard characters. `?` represents a single wildcard character.
+package pattern
+
+import "strings"
+
+// WildcardMatchCaseInsensitive returns true if text matches pattern (case-insensitive); returns false otherwise.
+func WildcardMatchCaseInsensitive(pattern string, text string) bool {
+	return WildcardMatch(pattern, text, true)
+}
+
+// WildcardMatch returns true if text matches pattern at the given case-sensitivity; returns false otherwise.
+func WildcardMatch(pattern string, text string, caseInsensitive bool) bool {
+	patternLen := len(pattern)
+	textLen := len(text)
+	if 0 == patternLen {
+		return 0 == textLen
+	}
+
+	if isWildcardGlob(pattern) {
+		return true
+	}
+
+	if caseInsensitive {
+		pattern = strings.ToLower(pattern)
+		text = strings.ToLower(text)
+	}
+
+	indexOfGlob := strings.Index(pattern, "*")
+	if -1 == indexOfGlob || patternLen-1 == indexOfGlob {
+		return simpleWildcardMatch(pattern, text)
+	}
+
+	res := make([]bool, textLen+1)
+	res[0] = true
+	for j := 0; j < patternLen; j++ {
+		p := pattern[j]
+		if '*' != p {
+			for i := textLen - 1; i >= 0; i-- {
+				t := text[i]
+				res[i+1] = res[i] && ('?' == p || t == p)
+			}
+		} else {
+			i := 0
+			for i <= textLen && !res[i] {
+				i++
+			}
+			for i <= textLen {
+				res[i] = true
+				i++
+			}
+		}
+		res[0] = res[0] && '*' == p
+	}
+	return res[textLen]
+
+}
+
+func simpleWildcardMatch(pattern string, text string) bool {
+	j := 0
+	patternLen := len(pattern)
+	textLen := len(text)
+	for i := 0; i < patternLen; i++ {
+		p := pattern[i]
+		if '*' == p {
+			return true
+		} else if '?' == p {
+			if textLen == j {
+				return false
+			}
+			j++
+		} else {
+			if j >= textLen {
+				return false
+			}
+			t := text[j]
+			if p != t {
+				return false
+			}
+			j++
+		}
+	}
+	return j == textLen
+}
+
+func isWildcardGlob(pattern string) bool {
+	return pattern == "*"
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/resources/AWSWhitelist.json b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/resources/AWSWhitelist.json
new file mode 100644
index 00000000..904510d6
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/resources/AWSWhitelist.json
@@ -0,0 +1,452 @@
+{
+  "services": {
+    "dynamodb": {
+      "operations": {
+        "BatchGetItem": {
+          "request_descriptors": {
+            "RequestItems": {
+              "map": true,
+              "get_keys": true,
+              "rename_to": "table_names"
+            }
+          },
+          "response_parameters": [
+            "ConsumedCapacity"
+          ]
+        },
+        "BatchWriteItem": {
+          "request_descriptors": {
+            "RequestItems": {
+              "map": true,
+              "get_keys": true,
+              "rename_to": "table_names"
+            }
+          },
+          "response_parameters": [
+            "ConsumedCapacity",
+            "ItemCollectionMetrics"
+          ]
+        },
+        "CreateTable": {
+          "request_parameters": [
+            "GlobalSecondaryIndexes",
+            "LocalSecondaryIndexes",
+            "ProvisionedThroughput",
+            "TableName"
+          ]
+        },
+        "DeleteItem": {
+          "request_parameters": [
+            "TableName"
+          ],
+          "response_parameters": [
+            "ConsumedCapacity",
+            "ItemCollectionMetrics"
+          ]
+        },
+        "DeleteTable": {
+          "request_parameters": [
+            "TableName"
+          ]
+        },
+        "DescribeTable": {
+          "request_parameters": [
+            "TableName"
+          ]
+        },
+        "GetItem": {
+          "request_parameters": [
+            "ConsistentRead",
+            "ProjectionExpression",
+            "TableName"
+          ],
+          "response_parameters": [
+            "ConsumedCapacity"
+          ]
+        },
+        "ListTables": {
+          "request_parameters": [
+            "ExclusiveStartTableName",
+            "Limit"
+          ],
+          "response_descriptors": {
+            "TableNames": {
+              "list": true,
+              "get_count": true,
+              "rename_to": "table_count"
+            }
+          }
+        },
+        "PutItem": {
+          "request_parameters": [
+            "TableName"
+          ],
+          "response_parameters": [
+            "ConsumedCapacity",
+            "ItemCollectionMetrics"
+          ]
+        },
+        "Query": {
+          "request_parameters": [
+            "AttributesToGet",
+            "ConsistentRead",
+            "IndexName",
+            "Limit",
+            "ProjectionExpression",
+            "ScanIndexForward",
+            "Select",
+            "TableName"
+          ],
+          "response_parameters": [
+            "ConsumedCapacity"
+          ]
+        },
+        "Scan": {
+          "request_parameters": [
+            "AttributesToGet",
+            "ConsistentRead",
+            "IndexName",
+            "Limit",
+            "ProjectionExpression",
+            "Segment",
+            "Select",
+            "TableName",
+            "TotalSegments"
+          ],
+          "response_parameters": [
+            "ConsumedCapacity",
+            "Count",
+            "ScannedCount"
+          ]
+        },
+        "UpdateItem": {
+          "request_parameters": [
+            "TableName"
+          ],
+          "response_parameters": [
+            "ConsumedCapacity",
+            "ItemCollectionMetrics"
+          ]
+        },
+        "UpdateTable": {
+          "request_parameters": [
+            "AttributeDefinitions",
+            "GlobalSecondaryIndexUpdates",
+            "ProvisionedThroughput",
+            "TableName"
+          ]
+        }
+      }
+    },
+    "sqs": {
+      "operations": {
+        "AddPermission": {
+          "request_parameters": [
+            "Label",
+            "QueueUrl"
+          ]
+        },
+        "ChangeMessageVisibility": {
+          "request_parameters": [
+            "QueueUrl",
+            "VisibilityTimeout"
+          ]
+        },
+        "ChangeMessageVisibilityBatch": {
+          "request_parameters": [
+            "QueueUrl"
+          ],
+          "response_parameters": [
+            "Failed"
+          ]
+        },
+        "CreateQueue": {
+          "request_parameters": [
+            "Attributes",
+            "QueueName"
+          ]
+        },
+        "DeleteMessage": {
+          "request_parameters": [
+            "QueueUrl"
+          ]
+        },
+        "DeleteMessageBatch": {
+          "request_parameters": [
+            "QueueUrl"
+          ],
+          "response_parameters": [
+            "Failed"
+          ]
+        },
+        "DeleteQueue": {
+          "request_parameters": [
+            "QueueUrl"
+          ]
+        },
+        "GetQueueAttributes": {
+          "request_parameters": [
+            "QueueUrl"
+          ],
+          "response_parameters": [
+            "Attributes"
+          ]
+        },
+        "GetQueueUrl": {
+          "request_parameters": [
+            "QueueName",
+            "QueueOwnerAWSAccountId"
+          ],
+          "response_parameters": [
+            "QueueUrl"
+          ]
+        },
+        "ListDeadLetterSourceQueues": {
+          "request_parameters": [
+            "QueueUrl"
+          ],
+          "response_parameters": [
+            "QueueUrls"
+          ]
+        },
+        "ListQueues": {
+          "request_parameters": [
+            "QueueNamePrefix"
+          ],
+          "response_descriptors": {
+            "QueueUrls": {
+              "list": true,
+              "get_count": true,
+              "rename_to": "queue_count"
+            }
+          }
+        },
+        "PurgeQueue": {
+          "request_parameters": [
+            "QueueUrl"
+          ]
+        },
+        "ReceiveMessage": {
+          "request_parameters": [
+            "AttributeNames",
+            "MaxNumberOfMessages",
+            "MessageAttributeNames",
+            "QueueUrl",
+            "VisibilityTimeout",
+            "WaitTimeSeconds"
+          ],
+          "response_descriptors": {
+            "Messages": {
+              "list": true,
+              "get_count": true,
+              "rename_to": "message_count"
+            }
+          }
+        },
+        "RemovePermission": {
+          "request_parameters": [
+            "QueueUrl"
+          ]
+        },
+        "SendMessage": {
+          "request_parameters": [
+            "DelaySeconds",
+            "QueueUrl"
+          ],
+          "request_descriptors": {
+            "MessageAttributes": {
+              "map": true,
+              "get_keys": true,
+              "rename_to": "message_attribute_names"
+            }
+          },
+          "response_parameters": [
+            "MessageId"
+          ]
+        },
+        "SendMessageBatch": {
+          "request_parameters": [
+            "QueueUrl"
+          ],
+          "request_descriptors": {
+            "Entries": {
+              "list": true,
+              "get_count": true,
+              "rename_to": "message_count"
+            }
+          },
+          "response_descriptors": {
+            "Failed": {
+              "list": true,
+              "get_count": true,
+              "rename_to": "failed_count"
+            },
+            "Successful": {
+              "list": true,
+              "get_count": true,
+              "rename_to": "successful_count"
+            }
+          }
+        },
+        "SetQueueAttributes": {
+          "request_parameters": [
+            "QueueUrl"
+          ],
+          "request_descriptors": {
+            "Attributes": {
+              "map": true,
+              "get_keys": true,
+              "rename_to": "attribute_names"
+            }
+          }
+        }
+      }
+    },
+    "lambda": {
+      "operations": {
+        "Invoke": {
+          "request_parameters": [
+            "FunctionName",
+            "InvocationType",
+            "LogType",
+            "Qualifier"
+          ],
+          "response_parameters": [
+            "FunctionError",
+            "StatusCode"
+          ]
+        },
+        "InvokeAsync": {
+          "request_parameters": [
+            "FunctionName"
+          ],
+          "response_parameters": [
+            "Status"
+          ]
+        }
+      }
+    },
+    "s3": {
+      "operations": {
+        "CreateBucket": {
+          "request_descriptors": {
+            "Bucket": {
+              "value": true,
+              "rename_to": "bucket_name"
+            }
+          }
+        },
+        "DeleteBucket": {
+          "request_descriptors": {
+            "Bucket": {
+              "value": true,
+              "rename_to": "bucket_name"
+            }
+          }
+        },
+        "GetObject": {
+          "request_parameters": [
+            "Key"
+          ],
+          "request_descriptors": {
+            "Bucket": {
+              "value": true,
+              "rename_to": "bucket_name"
+            }
+          }
+        },
+        "DeleteObject": {
+          "request_parameters": [
+            "Key"
+          ],
+          "request_descriptors": {
+            "Bucket": {
+              "value": true,
+              "rename_to": "bucket_name"
+            }
+          },
+          "response_parameters": [
+            "DeleteMarker"
+          ]
+        },
+        "DeleteObjects": {
+          "request_descriptors": {
+            "Bucket": {
+              "value": true,
+              "rename_to": "bucket_name"
+            }
+          },
+          "response_descriptors": {
+            "Deleted": {
+              "list": true,
+              "get_count": true,
+              "rename_to": "deleted_object_count"
+            }
+          }
+        },
+        "ListBuckets": {
+          "response_descriptors": {
+            "Buckets": {
+              "list": true,
+              "get_count": true,
+              "rename_to": "bucket_count"
+            }
+          }
+        },
+        "ListObjects": {
+          "request_descriptors": {
+            "Bucket": {
+              "value": true,
+              "rename_to": "bucket_name"
+            }
+          },
+          "response_descriptors": {
+            "Contents": {
+              "list": true,
+              "get_count": true,
+              "rename_to": "object_count"
+            }
+          }
+        },
+        "PutObject": {
+          "request_parameters": [
+            "Key"
+          ],
+          "request_descriptors": {
+            "Bucket": {
+              "value": true,
+              "rename_to": "bucket_name"
+            }
+          }
+        },
+        "PutBucketLogging": {
+          "request_descriptors": {
+            "Bucket": {
+              "value": true,
+              "rename_to": "bucket_name"
+            }
+          }
+        },
+        "PutBucketPolicy": {
+          "request_parameters": [
+            "Policy"
+          ],
+          "request_descriptors": {
+            "Bucket": {
+              "value": true,
+              "rename_to": "bucket_name"
+            }
+          }
+        },
+        "PutBucketTagging": {
+          "request_descriptors": {
+            "Bucket": {
+              "value": true,
+              "rename_to": "bucket_name"
+            }
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/resources/DefaultSamplingRules.json b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/resources/DefaultSamplingRules.json
new file mode 100644
index 00000000..4855f43f
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/resources/DefaultSamplingRules.json
@@ -0,0 +1,9 @@
+{
+  "version": 1,
+  "default": {
+    "fixed_target": 1,
+    "rate": 0.05
+  },
+  "rules": [
+  ]
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/resources/ExampleSamplingRules.json b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/resources/ExampleSamplingRules.json
new file mode 100644
index 00000000..18ec2de4
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/resources/ExampleSamplingRules.json
@@ -0,0 +1,19 @@
+{
+  "version": 1,
+  "default": {
+    "description": "A default rule, as included below, is required in any sampling rules file. (service_name, http_method, and url_path are fixed to '*' for this rule.)",
+    "fixed_target": 1,
+    "rate": 0.05
+  },
+  "rules": [
+    {
+      "description": "Example path-based rule below. Rules are evaluated in id-order, the default rule will be used if none match the incoming request. This is a rule for the checkout page.",
+      "id": "1",
+      "service_name": "*",
+      "http_method": "*",
+      "url_path": "/checkout",
+      "fixed_target": 10,
+      "rate": 0.05
+    }
+  ]
+}
\ No newline at end of file
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/resources/bindata.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/resources/bindata.go
new file mode 100644
index 00000000..22d05656
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/resources/bindata.go
@@ -0,0 +1,283 @@
+// Code generated by go-bindata.
+// sources:
+// resources/AWSWhitelist.json
+// resources/DefaultSamplingRules.json
+// resources/ExampleSamplingRules.json
+// DO NOT EDIT!
+
+package resources
+
+import (
+	"bytes"
+	"compress/gzip"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+func bindataRead(data []byte, name string) ([]byte, error) {
+	gz, err := gzip.NewReader(bytes.NewBuffer(data))
+	if err != nil {
+		return nil, fmt.Errorf("Read %q: %v", name, err)
+	}
+
+	var buf bytes.Buffer
+	_, err = io.Copy(&buf, gz)
+	clErr := gz.Close()
+
+	if err != nil {
+		return nil, fmt.Errorf("Read %q: %v", name, err)
+	}
+	if clErr != nil {
+		return nil, err
+	}
+
+	return buf.Bytes(), nil
+}
+
+type asset struct {
+	bytes []byte
+	info  os.FileInfo
+}
+
+type bindataFileInfo struct {
+	name    string
+	size    int64
+	mode    os.FileMode
+	modTime time.Time
+}
+
+func (fi bindataFileInfo) Name() string {
+	return fi.name
+}
+func (fi bindataFileInfo) Size() int64 {
+	return fi.size
+}
+func (fi bindataFileInfo) Mode() os.FileMode {
+	return fi.mode
+}
+func (fi bindataFileInfo) ModTime() time.Time {
+	return fi.modTime
+}
+func (fi bindataFileInfo) IsDir() bool {
+	return false
+}
+func (fi bindataFileInfo) Sys() interface{} {
+	return nil
+}
+
+var _resourcesAwswhitelistJson = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xec\x59\xcd\x72\xe2\x38\x10\xbe\xf3\x14\x2e\x9f\x73\xdb\x5b\x6e\x0c\x49\x28\x6a\xc9\x84\x04\x66\x73\xd8\xda\xa2\x64\xa9\x71\x34\xb1\x25\x47\x3f\x0c\xd4\x56\xde\x7d\x4b\x92\x21\x60\x8c\x2d\xec\xc0\x90\x64\x0f\x53\x13\xac\xb6\xfa\xeb\xaf\x7f\xd4\x2d\xff\xdb\x09\x82\x50\x82\x98\x53\x0c\x32\xbc\x0c\xcc\xef\x20\x08\xc9\x92\xa1\x94\x93\x68\xfd\x24\x08\x42\x9e\x81\x40\x8a\x72\x26\x37\x9e\x06\x41\xf8\x0d\x29\xfc\xd4\x07\x35\x50\x90\x6e\xad\x04\x41\x28\xe0\x45\x83\x54\x53\x02\x12\x0b\x9a\x29\x2e\x64\x41\x24\x08\xc2\x07\x27\x64\xde\xdf\x5d\x0d\x82\x30\x45\x59\x78\x19\x28\xa1\xe1\xa2\xb8\x14\x83\x9a\x3e\xc3\x52\xee\x5b\x17\xc0\x50\x0a\x53\xc5\xc3\xcb\x20\x54\x28\x4a\x60\x6a\x1e\xc8\x70\x4b\xf0\x75\xe3\xd7\xeb\xc5\x36\x7e\x99\x71\x26\x61\x9a\x21\x81\x52\x50\x60\xf1\xff\xbd\x8d\xbf\xc7\x99\xd4\x29\x90\x1e\xca\x10\xa6\x6a\xb9\xb9\xf9\x3f\x9d\x92\x8d\x1d\x65\x8f\x82\x2a\xf8\x9f\xb4\x15\x69\xdb\x30\x42\x63\x58\x8f\x27\x09\x60\x13\x72\xb7\xa0\x04\xc5\xb2\x9e\xd9\x9e\x00\xa4\x60\x62\x40\xef\xa3\xb5\x0a\x55\x3f\xe1\x11\x4a\xc6\x80\x39\x23\x48\x2c\x07\x8c\xc0\x02\x64\x11\xdb\x90\xe3\x7a\xa1\x91\xe0\x73\x2a\x29\x67\x40\x26\x4f\x82\xeb\xf8\x29\xd3\xaa\x28\x64\x81\x7e\x47\x29\xd4\x5b\x76\x05\x09\x54\xc7\x4b\x95\x61\xe5\x8a\xce\xc6\x6d\xce\xb8\xc6\x6e\x3b\x88\x46\x93\x54\xd1\x49\x74\xd5\x14\xc5\x3a\x9e\xa9\x54\xc0\xd4\x03\x20\x52\x12\x5b\x3f\x1d\xc3\xd7\x8b\x4c\x80\x34\x61\xe6\x17\x5a\xa7\xa8\x6e\x43\x2a\x95\xd5\x5e\x2c\x4c\x5e\x96\x5f\x2f\x70\xa2\x25\x9d\xc3\x58\x21\xa1\xde\xac\x28\xe6\x20\x4d\xa9\xf2\x30\xad\xb2\x88\xae\x77\x2f\x2d\xa1\x09\x95\xaa\xaa\x86\x62\xae\xd9\x5e\x81\x92\x22\xea\xe4\xf7\x17\xd1\x52\x32\x47\xba\x71\x0c\x9d\x79\xce\xdf\x6b\x10\xcb\x26\x76\x75\x95\x12\x34\xd2\x0a\xe4\x84\xf7\x61\xa7\xa6\x56\xa7\x8e\xad\xd6\xfb\x03\xaa\x41\xa2\x8d\x31\x62\x76\xd7\x1b\x2e\x7e\x21\xb1\xa3\x71\x0c\x86\x99\xf3\x49\x4f\x83\xf7\x33\xd0\x0e\x71\x0a\x6c\xe7\xd5\x3a\xb6\x8b\x0b\x5c\x99\xa3\xdc\x6e\x25\x8f\x9c\x27\x3d\x9b\xff\x25\xd1\xc3\x80\xf4\x8a\xb5\xa1\xdc\x77\x3f\x32\x82\x3e\x6d\x13\xe0\x8c\x6b\x7c\x30\xaf\xe3\xf3\x0a\x66\x94\x51\x37\xa9\x5c\xd4\xf7\x77\x4e\xed\x71\xfa\xb7\xce\xe6\xff\xb9\xad\xa1\x7c\x91\x3e\x73\x55\x97\x90\x11\x88\x94\xba\xe8\x6f\x40\xc8\x10\x45\x90\x14\x11\xdf\x6b\xd0\xf0\x43\x24\x1e\xad\xf4\x13\x62\x31\xdc\x82\x94\x28\x86\xbf\xa8\xa4\x11\x4d\x8c\xb3\x1b\x20\x59\x2b\x2d\x80\x79\xdb\x75\x42\x53\xe0\xda\x23\x03\xf6\xa0\xb2\x13\x55\x2b\x68\xed\x52\xe2\x06\xd1\x04\x88\xef\x7c\x62\x95\xb6\xab\xc1\xa5\x7e\x3d\x64\x92\xc8\x29\x7c\x37\xce\xea\x55\x7d\x14\x1f\x39\xd0\x8d\x7d\xe4\xcf\x4e\x1f\x94\x15\xde\xf0\xea\xef\x63\x67\x03\x84\x37\x70\xa3\xb5\x29\xe2\xb2\xd3\xd8\x2e\xdc\xfd\x62\x20\xba\x8f\xe3\x2e\xb6\x0d\xf3\x80\xb4\x34\xcc\xdf\x1f\x66\x70\xb9\x02\x44\x86\xa0\x14\x88\x31\xd7\x02\xbb\x30\xf8\x9d\x7e\x59\x6d\xe3\xe1\x16\x83\xbf\x25\x5e\xe3\x95\x91\x80\x19\x5d\xb4\x9d\xad\xde\x70\x1f\x75\xb4\x7a\x31\x6a\x9a\x8e\x56\x22\x3e\x45\x9a\x3f\x00\x06\x3a\x6f\x53\x70\xd7\xb9\xe9\x66\xd5\x42\xd6\xdc\xa2\xc5\x77\x9d\x46\x20\xee\x66\xb9\x8e\x5d\x11\xf7\xbc\x7a\x1f\xff\x53\xba\x20\xf0\x88\xa8\x32\x4b\xae\xaf\xf2\x69\xa3\x2b\x23\x67\x6d\xc4\x51\x03\x27\x75\x5a\x9a\x85\xce\x03\xa4\x7c\x0e\xed\xda\x33\xff\x00\x1a\x03\x23\x2d\xa2\xe7\x0a\x12\xb4\x5c\xf9\xc6\xa7\x1d\xbc\x28\xd3\xe0\xe3\xb2\xbd\x07\x99\x15\x7a\xaf\x2b\xe9\x95\xe7\xd0\x4a\xdb\x11\xae\xa7\x73\x83\x06\x1e\xed\xc2\x86\x77\x8e\xda\xe1\x78\xb8\xe1\x9a\x29\x41\xcf\x25\x71\x1a\x64\x7e\xde\xa1\x1d\x15\xfe\xcc\xea\x28\x45\x5f\x1c\xcd\x35\xc6\x20\xe5\x4c\x17\x9b\x9c\x77\x46\x24\xd7\x7a\x9a\x15\xa3\xf1\xc9\xda\x48\x8f\x10\x3c\x4d\x09\xf0\x4f\xfd\x4e\xf1\xaf\xed\x59\x3c\x41\x69\x44\x90\xcf\x38\x3e\x60\x73\xfe\xdc\xa8\xfe\xde\x68\x66\x2f\x42\xca\x3a\x5e\xb3\x2b\xb6\xea\x26\xcb\x6c\xf7\x72\x8c\xc7\x65\x8f\xef\x35\x4a\xe8\x8c\x82\x68\x3b\x10\xe5\xc0\xae\x85\xe0\x62\xe7\x62\x4a\x21\xa5\x65\x8f\x13\x8f\x89\xd2\x71\xd3\x95\x4b\x86\x5b\x13\xd4\xce\x24\x87\xfa\xa0\xdb\x98\x3f\x7c\xbc\xef\xe6\xf6\x6f\x1a\x3f\x83\x6a\xf4\xbd\xb6\xf4\x55\xbb\x32\x47\x89\xed\x40\xeb\xa3\x3e\xb2\x7b\xd8\x90\x3f\xb4\x46\xb8\x99\xf6\xe3\xe2\xef\x83\xba\x8b\x7e\x02\xde\x0b\xbe\x2a\x28\xfe\x84\x65\xcb\xaa\x76\x16\xde\xfb\x1a\x04\x1c\x9e\xf3\xf9\x25\x13\x12\xcf\x85\x8a\x58\xcb\xe5\xde\x83\xf2\xac\xb9\xa8\x04\xe7\xcc\x3b\x72\x0f\x45\x9c\x92\x29\xb7\x2c\x36\xeb\x5a\x86\x54\x2a\xc7\x64\x89\x17\x7c\x2c\x2d\x7f\xf9\x9d\x2d\xcd\xfd\xd4\xd8\xc2\x4f\x1b\x67\x3d\xce\x94\xfd\x66\x76\x54\xfa\xdb\x04\xd8\x48\x7f\xe5\x23\x63\xa4\xf3\xec\x1a\xf2\x38\xa6\x2c\x3e\xf3\x08\xac\xb6\x61\xc4\x13\x8a\x1b\x7d\x79\xca\xdf\xfc\x1c\xae\x9c\xa0\x8f\xe5\xca\xed\x7e\xbb\x63\xfe\xbd\x76\xfe\x0b\x00\x00\xff\xff\x43\xa8\x98\xe0\x72\x2a\x00\x00")
+
+func resourcesAwswhitelistJsonBytes() ([]byte, error) {
+	return bindataRead(
+		_resourcesAwswhitelistJson,
+		"resources/AWSWhitelist.json",
+	)
+}
+
+func resourcesAwswhitelistJson() (*asset, error) {
+	bytes, err := resourcesAwswhitelistJsonBytes()
+	if err != nil {
+		return nil, err
+	}
+
+	info := bindataFileInfo{name: "resources/AWSWhitelist.json", size: 10866, mode: os.FileMode(420), modTime: time.Unix(1504302313, 0)}
+	a := &asset{bytes: bytes, info: info}
+	return a, nil
+}
+
+var _resourcesDefaultsamplingrulesJson = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xaa\xe6\x52\x50\x50\x2a\x4b\x2d\x2a\xce\xcc\xcf\x53\xb2\x52\x30\xd4\x01\xf1\x53\x52\xd3\x12\x4b\x73\x4a\x94\xac\x14\x40\xd2\x0a\x0a\x4a\x69\x99\x15\xa9\x29\xf1\x25\x89\x45\xe9\xa9\x25\x30\x55\x0a\x0a\x4a\x45\x89\x25\xa9\x4a\x56\x0a\x06\x7a\x06\xa6\x5c\x0a\x0a\xb5\x60\xbd\x45\xa5\x39\xa9\xc5\x4a\x56\x0a\xd1\x5c\x0a\x0a\xb1\x5c\xb5\x5c\x80\x00\x00\x00\xff\xff\xc9\x98\x17\x60\x61\x00\x00\x00")
+
+func resourcesDefaultsamplingrulesJsonBytes() ([]byte, error) {
+	return bindataRead(
+		_resourcesDefaultsamplingrulesJson,
+		"resources/DefaultSamplingRules.json",
+	)
+}
+
+func resourcesDefaultsamplingrulesJson() (*asset, error) {
+	bytes, err := resourcesDefaultsamplingrulesJsonBytes()
+	if err != nil {
+		return nil, err
+	}
+
+	info := bindataFileInfo{name: "resources/DefaultSamplingRules.json", size: 97, mode: os.FileMode(420), modTime: time.Unix(1504288305, 0)}
+	a := &asset{bytes: bytes, info: info}
+	return a, nil
+}
+
+var _resourcesExamplesamplingrulesJson = []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x64\x90\xcd\x8e\xd4\x30\x10\x84\xef\x79\x8a\x92\x2f\x0b\xab\x6c\x98\x3d\x70\xc9\x8d\x03\x2f\x80\xb8\x21\x14\xf5\xc4\x9d\x49\x0b\xc7\xce\xda\xed\xd9\x45\x68\xde\x1d\xd9\xd9\x61\x7e\x38\xba\xab\xda\x5d\x5f\xfd\x69\x00\x73\xe4\x98\x24\x78\xd3\xe3\xb9\x2d\x6f\xcb\x13\x65\xa7\xa6\x47\x91\xeb\x20\x8d\x51\x56\xdd\x4c\xe6\x0b\xde\x1d\x88\xd9\x71\x0b\x4a\x10\x3f\xba\x6c\xd9\x62\xcf\x2e\xbc\xb6\x90\x84\xc8\x2f\x59\x22\x5b\x88\x07\xf9\xdf\x48\xb4\xac\x4e\xfc\xa1\x2e\x25\x4c\xe2\xb8\xc3\x87\xc4\xf1\x28\x23\x0f\x9e\x16\x6e\x31\xab\xae\xc3\xc2\x3a\x07\xdb\x82\xbc\x45\x8e\x6e\x58\x49\x67\x50\x64\x4c\xf2\xc6\x16\x1a\xf0\xf0\xf8\x80\x29\x44\xe8\x5c\xee\x64\xc7\xdd\x47\xd3\x6e\x51\xab\x67\x50\x8a\x07\xd6\x33\x10\x60\x22\x29\x9b\x1e\xbb\x6e\xf7\xb9\x01\x4e\x15\xb3\xe6\x30\x3d\x7e\x54\xcb\x86\xfa\x3f\xec\xd7\xb7\x92\x9b\x51\x52\x3c\xed\x29\xb1\xad\x17\x37\xd0\x0e\xdf\x2a\x4c\x49\xc7\x47\x72\x99\x74\x03\x16\xfb\x14\xa2\xe5\xd8\x42\x67\xbe\xa9\x0b\xaf\xe2\x1c\xf6\x8c\x5c\xbe\x92\x09\x3e\x78\xc6\x42\x3a\xce\xd5\x2b\x7e\x0c\x4b\xad\x89\x5f\x32\x27\xed\xf0\xbd\x50\x4a\x02\x6d\xfb\x1b\x38\x63\x9c\x79\xfc\x15\xb2\x62\xa5\x03\x77\xef\xfc\x80\x11\x5b\x62\x3f\x5f\x06\xd7\x15\x17\xe9\xf1\x22\x5d\xf5\x7d\xa7\x9c\x8b\x2f\xe3\x4f\xe7\x53\x17\xf9\xbe\xe6\xdd\x3f\xe5\xb6\x69\xe0\xd4\x00\x3f\x9b\xd3\xdf\x00\x00\x00\xff\xff\xc1\xd0\x29\x3f\x69\x02\x00\x00")
+
+func resourcesExamplesamplingrulesJsonBytes() ([]byte, error) {
+	return bindataRead(
+		_resourcesExamplesamplingrulesJson,
+		"resources/ExampleSamplingRules.json",
+	)
+}
+
+func resourcesExamplesamplingrulesJson() (*asset, error) {
+	bytes, err := resourcesExamplesamplingrulesJsonBytes()
+	if err != nil {
+		return nil, err
+	}
+
+	info := bindataFileInfo{name: "resources/ExampleSamplingRules.json", size: 617, mode: os.FileMode(420), modTime: time.Unix(1504288305, 0)}
+	a := &asset{bytes: bytes, info: info}
+	return a, nil
+}
+
+// Asset loads and returns the asset for the given name.
+// It returns an error if the asset could not be found or
+// could not be loaded.
+func Asset(name string) ([]byte, error) {
+	cannonicalName := strings.Replace(name, "\\", "/", -1)
+	if f, ok := _bindata[cannonicalName]; ok {
+		a, err := f()
+		if err != nil {
+			return nil, fmt.Errorf("Asset %s can't read by error: %v", name, err)
+		}
+		return a.bytes, nil
+	}
+	return nil, fmt.Errorf("Asset %s not found", name)
+}
+
+// MustAsset is like Asset but panics when Asset would return an error.
+// It simplifies safe initialization of global variables.
+func MustAsset(name string) []byte {
+	a, err := Asset(name)
+	if err != nil {
+		panic("asset: Asset(" + name + "): " + err.Error())
+	}
+
+	return a
+}
+
+// AssetInfo loads and returns the asset info for the given name.
+// It returns an error if the asset could not be found or
+// could not be loaded.
+func AssetInfo(name string) (os.FileInfo, error) {
+	cannonicalName := strings.Replace(name, "\\", "/", -1)
+	if f, ok := _bindata[cannonicalName]; ok {
+		a, err := f()
+		if err != nil {
+			return nil, fmt.Errorf("AssetInfo %s can't read by error: %v", name, err)
+		}
+		return a.info, nil
+	}
+	return nil, fmt.Errorf("AssetInfo %s not found", name)
+}
+
+// AssetNames returns the names of the assets.
+func AssetNames() []string {
+	names := make([]string, 0, len(_bindata))
+	for name := range _bindata {
+		names = append(names, name)
+	}
+	return names
+}
+
+// _bindata is a table, holding each asset generator, mapped to its name.
+var _bindata = map[string]func() (*asset, error){
+	"resources/AWSWhitelist.json": resourcesAwswhitelistJson,
+	"resources/DefaultSamplingRules.json": resourcesDefaultsamplingrulesJson,
+	"resources/ExampleSamplingRules.json": resourcesExamplesamplingrulesJson,
+}
+
+// AssetDir returns the file names below a certain
+// directory embedded in the file by go-bindata.
+// For example if you run go-bindata on data/... and data contains the
+// following hierarchy:
+//     data/
+//       foo.txt
+//       img/
+//         a.png
+//         b.png
+// then AssetDir("data") would return []string{"foo.txt", "img"}
+// AssetDir("data/img") would return []string{"a.png", "b.png"}
+// AssetDir("foo.txt") and AssetDir("notexist") would return an error
+// AssetDir("") will return []string{"data"}.
+func AssetDir(name string) ([]string, error) {
+	node := _bintree
+	if len(name) != 0 {
+		cannonicalName := strings.Replace(name, "\\", "/", -1)
+		pathList := strings.Split(cannonicalName, "/")
+		for _, p := range pathList {
+			node = node.Children[p]
+			if node == nil {
+				return nil, fmt.Errorf("Asset %s not found", name)
+			}
+		}
+	}
+	if node.Func != nil {
+		return nil, fmt.Errorf("Asset %s not found", name)
+	}
+	rv := make([]string, 0, len(node.Children))
+	for childName := range node.Children {
+		rv = append(rv, childName)
+	}
+	return rv, nil
+}
+
+type bintree struct {
+	Func     func() (*asset, error)
+	Children map[string]*bintree
+}
+var _bintree = &bintree{nil, map[string]*bintree{
+	"resources": &bintree{nil, map[string]*bintree{
+		"AWSWhitelist.json": &bintree{resourcesAwswhitelistJson, map[string]*bintree{}},
+		"DefaultSamplingRules.json": &bintree{resourcesDefaultsamplingrulesJson, map[string]*bintree{}},
+		"ExampleSamplingRules.json": &bintree{resourcesExamplesamplingrulesJson, map[string]*bintree{}},
+	}},
+}}
+
+// RestoreAsset restores an asset under the given directory
+func RestoreAsset(dir, name string) error {
+	data, err := Asset(name)
+	if err != nil {
+		return err
+	}
+	info, err := AssetInfo(name)
+	if err != nil {
+		return err
+	}
+	err = os.MkdirAll(_filePath(dir, filepath.Dir(name)), os.FileMode(0755))
+	if err != nil {
+		return err
+	}
+	err = ioutil.WriteFile(_filePath(dir, name), data, info.Mode())
+	if err != nil {
+		return err
+	}
+	err = os.Chtimes(_filePath(dir, name), info.ModTime(), info.ModTime())
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+// RestoreAssets restores an asset under the given directory recursively
+func RestoreAssets(dir, name string) error {
+	children, err := AssetDir(name)
+	// File
+	if err != nil {
+		return RestoreAsset(dir, name)
+	}
+	// Dir
+	for _, child := range children {
+		err = RestoreAssets(dir, filepath.Join(name, child))
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func _filePath(dir, name string) string {
+	cannonicalName := strings.Replace(name, "\\", "/", -1)
+	return filepath.Join(append([]string{dir}, strings.Split(cannonicalName, "/")...)...)
+}
+
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/ctxmissing/context_missing.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/ctxmissing/context_missing.go
new file mode 100644
index 00000000..487d5396
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/ctxmissing/context_missing.go
@@ -0,0 +1,18 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+// Package ctxmissing provides control over
+// the behavior of the X-Ray SDK when subsegments
+// are created without a provided parent segment.
+package ctxmissing
+
+// Strategy provides an interface for
+// implementing context missing strategies.
+type Strategy interface {
+	ContextMissing(v interface{})
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/ctxmissing/default_context_missing.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/ctxmissing/default_context_missing.go
new file mode 100644
index 00000000..6983497c
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/ctxmissing/default_context_missing.go
@@ -0,0 +1,54 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package ctxmissing
+
+import (
+	log "github.com/cihub/seelog"
+)
+
+// RuntimeErrorStrategy provides the AWS_XRAY_CONTEXT_MISSING
+// environment variable value for enabling the runtime error
+// context missing strategy (panic).
+var RuntimeErrorStrategy = "RUNTIME_ERROR"
+
+// LogErrorStrategy provides the AWS_XRAY_CONTEXT_MISSING
+// environment variable value for enabling the log error
+// context missing strategy.
+var LogErrorStrategy = "LOG_ERROR"
+
+// DefaultRuntimeErrorStrategy implements the
+// runtime error context missing strategy.
+type DefaultRuntimeErrorStrategy struct{}
+
+// DefaultLogErrorStrategy implements the
+// log error context missing strategy.
+type DefaultLogErrorStrategy struct{}
+
+// NewDefaultRuntimeErrorStrategy initializes
+// an instance of DefaultRuntimeErrorStrategy.
+func NewDefaultRuntimeErrorStrategy() *DefaultRuntimeErrorStrategy {
+	return &DefaultRuntimeErrorStrategy{}
+}
+
+// NewDefaultLogErrorStrategy initializes
+// an instance of DefaultLogErrorStrategy.
+func NewDefaultLogErrorStrategy() *DefaultLogErrorStrategy {
+	return &DefaultLogErrorStrategy{}
+}
+
+// ContextMissing panics when the segment context is missing.
+func (dr *DefaultRuntimeErrorStrategy) ContextMissing(v interface{}) {
+	panic(v)
+}
+
+// ContextMissing logs an error message when the
+// segment context is missing.
+func (dl *DefaultLogErrorStrategy) ContextMissing(v interface{}) {
+	log.Errorf("Suppressing AWS X-Ray context missing panic: %v", v)
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/exception/default_exception_formatting_strategy.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/exception/default_exception_formatting_strategy.go
new file mode 100644
index 00000000..9636a6eb
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/exception/default_exception_formatting_strategy.go
@@ -0,0 +1,202 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package exception
+
+import (
+	"bytes"
+	"crypto/rand"
+	"fmt"
+	"runtime"
+	"strings"
+
+	"github.com/pkg/errors"
+)
+
+// StackTracer is an interface for implementing StackTrace method.
+type StackTracer interface {
+	StackTrace() []uintptr
+}
+
+// Exception provides the shape for unmarshaling an exception.
+type Exception struct {
+	ID      string  `json:"id,omitempty"`
+	Type    string  `json:"type,omitempty"`
+	Message string  `json:"message,omitempty"`
+	Stack   []Stack `json:"stack,omitempty"`
+}
+
+// Stack provides the shape for unmarshaling an stack.
+type Stack struct {
+	Path  string `json:"path,omitempty"`
+	Line  int    `json:"line,omitempty"`
+	Label string `json:"label,omitempty"`
+}
+
+// MultiError is a type for a slice of error.
+type MultiError []error
+
+// Error returns a string format of concatenating multiple errors.
+func (e MultiError) Error() string {
+	var buf bytes.Buffer
+	fmt.Fprintf(&buf, "%d errors occurred:\n", len(e))
+	for _, err := range e {
+		buf.WriteString("* ")
+		buf.WriteString(err.Error())
+		buf.WriteByte('\n')
+	}
+	return buf.String()
+}
+
+var defaultErrorFrameCount = 32
+
+// DefaultFormattingStrategy is the default implementation of
+// the ExceptionFormattingStrategy and has a configurable frame count.
+type DefaultFormattingStrategy struct {
+	FrameCount int
+}
+
+// NewDefaultFormattingStrategy initializes DefaultFormattingStrategy
+// with default value of frame count.
+func NewDefaultFormattingStrategy() (*DefaultFormattingStrategy, error) {
+	return &DefaultFormattingStrategy{FrameCount: defaultErrorFrameCount}, nil
+}
+
+// NewDefaultFormattingStrategyWithDefinedErrorFrameCount initializes
+// DefaultFormattingStrategy with customer defined frame count.
+func NewDefaultFormattingStrategyWithDefinedErrorFrameCount(frameCount int) (*DefaultFormattingStrategy, error) {
+	if frameCount > 32 || frameCount < 0 {
+		return nil, errors.New("frameCount must be a non-negative integer and less than 32")
+	}
+	return &DefaultFormattingStrategy{FrameCount: frameCount}, nil
+}
+
+// Error returns the value of XRayError by given error message.
+func (dEFS *DefaultFormattingStrategy) Error(message string) *XRayError {
+	s := make([]uintptr, dEFS.FrameCount)
+	n := runtime.Callers(2, s)
+	s = s[:n]
+
+	return &XRayError{
+		Type:    "error",
+		Message: message,
+		Stack:   s,
+	}
+}
+
+// Errorf formats according to a format specifier and returns value of XRayError.
+func (dEFS *DefaultFormattingStrategy) Errorf(formatString string, args ...interface{}) *XRayError {
+	e := dEFS.Error(fmt.Sprintf(formatString, args...))
+	e.Stack = e.Stack[1:]
+	return e
+}
+
+// Panic records error type as panic in segment and returns value of XRayError.
+func (dEFS *DefaultFormattingStrategy) Panic(message string) *XRayError {
+	e := dEFS.Error(message)
+	e.Type = "panic"
+	e.Stack = e.Stack[4:]
+	return e
+}
+
+// Panicf formats according to a format specifier and returns value of XRayError.
+func (dEFS *DefaultFormattingStrategy) Panicf(formatString string, args ...interface{}) *XRayError {
+	e := dEFS.Panic(fmt.Sprintf(formatString, args...))
+	e.Stack = e.Stack[1:]
+	return e
+}
+
+// ExceptionFromError takes an error and returns value of Exception
+func (dEFS *DefaultFormattingStrategy) ExceptionFromError(err error) Exception {
+	e := Exception{
+		ID:      newExceptionID(),
+		Type:    "error",
+		Message: err.Error(),
+	}
+
+	if err, ok := err.(*XRayError); ok {
+		e.Type = err.Type
+	}
+
+	var s []uintptr
+
+	// This is our publicly supported interface for passing along stack traces
+	if err, ok := err.(StackTracer); ok {
+		s = err.StackTrace()
+	}
+
+	// We also accept github.com/pkg/errors style stack traces for ease of use
+	if err, ok := err.(interface {
+		StackTrace() errors.StackTrace
+	}); ok {
+		for _, frame := range err.StackTrace() {
+			s = append(s, uintptr(frame))
+		}
+	}
+
+	if s == nil {
+		s = make([]uintptr, dEFS.FrameCount)
+		n := runtime.Callers(5, s)
+		s = s[:n]
+	}
+
+	e.Stack = convertStack(s)
+	return e
+}
+
+func newExceptionID() string {
+	var r [8]byte
+	_, err := rand.Read(r[:])
+	if err != nil {
+		panic(err)
+	}
+	return fmt.Sprintf("%02x", r)
+}
+
+func convertStack(s []uintptr) []Stack {
+	var r []Stack
+	frames := runtime.CallersFrames(s)
+
+	d := true
+	for frame, more := frames.Next(); d; frame, more = frames.Next() {
+		f := &Stack{}
+		f.Path, f.Line, f.Label = parseFrame(frame)
+		r = append(r, *f)
+		d = more
+	}
+	return r
+}
+
+func parseFrame(frame runtime.Frame) (string, int, string) {
+	path, line, label := frame.File, frame.Line, frame.Function
+
+	// Strip GOPATH from path by counting the number of seperators in label & path
+	// For example:
+	//   GOPATH = /home/user
+	//   path   = /home/user/src/pkg/sub/file.go
+	//   label  = pkg/sub.Type.Method
+	// We want to set path to:
+	//    pkg/sub/file.go
+	i := len(path)
+	for n, g := 0, strings.Count(label, "/")+2; n < g; n++ {
+		i = strings.LastIndex(path[:i], "/")
+		if i == -1 {
+			// Something went wrong and path has less seperators than we expected
+			// Abort and leave i as -1 to counteract the +1 below
+			break
+		}
+	}
+	path = path[i+1:] // Trim the initial /
+
+	// Strip the path from the function name as it's already in the path
+	label = label[strings.LastIndex(label, "/")+1:]
+	// Likewise strip the package name
+	label = label[strings.Index(label, ".")+1:]
+
+	return path, line, label
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/exception/exception_formatting_strategy.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/exception/exception_formatting_strategy.go
new file mode 100644
index 00000000..d240e23b
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/exception/exception_formatting_strategy.go
@@ -0,0 +1,18 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package exception
+
+// FormattingStrategy provides an interface for implementing methods that format errors and exceptions.
+type FormattingStrategy interface {
+	Error(message string) *XRayError
+	Errorf(formatString string, args ...interface{}) *XRayError
+	Panic(message string) *XRayError
+	Panicf(formatString string, args ...interface{}) *XRayError
+	ExceptionFromError(err error) Exception
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/exception/xray_error.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/exception/xray_error.go
new file mode 100644
index 00000000..a16e2a1d
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/exception/xray_error.go
@@ -0,0 +1,27 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package exception
+
+// XRayError records error type, message,
+// and a slice of stack frame pointers.
+type XRayError struct {
+	Type    string
+	Message string
+	Stack   []uintptr
+}
+
+// Error returns the value of error message.
+func (e *XRayError) Error() string {
+	return e.Message
+}
+
+// StackTrace returns a slice of integer pointers.
+func (e *XRayError) StackTrace() []uintptr {
+	return e.Stack
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/localized.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/localized.go
new file mode 100644
index 00000000..301fcd45
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/localized.go
@@ -0,0 +1,74 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package sampling
+
+import (
+	"github.com/aws/aws-xray-sdk-go/resources"
+	log "github.com/cihub/seelog"
+)
+
+// LocalizedStrategy makes trace sampling decisions based on
+// a set of rules provided in a local JSON file. Trace sampling
+// decisions are made by the root node in the trace. If a
+// sampling decision is made by the root service, it will be passed
+// to downstream services through the trace header.
+type LocalizedStrategy struct {
+	manifest *RuleManifest
+}
+
+// NewLocalizedStrategy initializes an instance of LocalizedStrategy
+// with the default trace sampling rules. The default rules sample
+// the first request per second, and 5% of requests thereafter.
+func NewLocalizedStrategy() (*LocalizedStrategy, error) {
+	bytes, err := resources.Asset("resources/DefaultSamplingRules.json")
+	if err != nil {
+		return nil, err
+	}
+	manifest, err := ManifestFromJSONBytes(bytes)
+	if err != nil {
+		return nil, err
+	}
+	return &LocalizedStrategy{manifest: manifest}, nil
+}
+
+// NewLocalizedStrategyFromFilePath initializes an instance of
+// LocalizedStrategy using a custom ruleset found at the filepath fp.
+func NewLocalizedStrategyFromFilePath(fp string) (*LocalizedStrategy, error) {
+	manifest, err := ManifestFromFilePath(fp)
+	if err != nil {
+		return nil, err
+	}
+	return &LocalizedStrategy{manifest: manifest}, nil
+}
+
+// NewLocalizedStrategyFromJSONBytes initializes an instance of
+// LocalizedStrategy using a custom ruleset provided in the json bytes b.
+func NewLocalizedStrategyFromJSONBytes(b []byte) (*LocalizedStrategy, error) {
+	manifest, err := ManifestFromJSONBytes(b)
+	if err != nil {
+		return nil, err
+	}
+	return &LocalizedStrategy{manifest: manifest}, nil
+}
+
+// ShouldTrace consults the LocalizedStrategy's rule set to determine
+// if the given request should be traced or not.
+func (lss *LocalizedStrategy) ShouldTrace(serviceName string, path string, method string) bool {
+	log.Tracef("Determining ShouldTrace decision for:\n\tserviceName: %s\n\tpath: %s\n\tmethod: %s", serviceName, path, method)
+	if nil != lss.manifest.Rules {
+		for _, r := range lss.manifest.Rules {
+			if r.AppliesTo(serviceName, path, method) {
+				log.Tracef("Applicable rule:\n\tfixed_target: %d\n\trate: %f\n\tservice_name: %s\n\turl_path: %s\n\thttp_method: %s", r.FixedTarget, r.Rate, r.ServiceName, r.URLPath, r.HTTPMethod)
+				return r.Sample()
+			}
+		}
+	}
+	log.Tracef("Default rule applies:\n\tfixed_target: %d\n\trate: %f", lss.manifest.Default.FixedTarget, lss.manifest.Default.Rate)
+	return lss.manifest.Default.Sample()
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/reservoir.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/reservoir.go
new file mode 100644
index 00000000..8d2fc755
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/reservoir.go
@@ -0,0 +1,81 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package sampling
+
+import (
+	"fmt"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+var maxRate uint64 = 1e8
+
+// Reservoir allows a specified amount of `Take()`s per second.
+// Support for atomic operations on uint64 is required.
+// More information: https://golang.org/pkg/sync/atomic/#pkg-note-BUG
+type Reservoir struct {
+	maskedCounter uint64
+	perSecond     uint64
+	mutex         sync.Mutex // don't use embedded struct to ensure 64 bit alignment for maskedCounter.
+}
+
+// NewReservoir creates a new reservoir with a specified perSecond
+// sampling capacity. The maximum supported sampling capacity per
+// second is currently 100,000,000. An error is returned if the
+// desired capacity is greater than this maximum value.
+func NewReservoir(perSecond uint64) (*Reservoir, error) {
+	if perSecond >= maxRate {
+		return nil, fmt.Errorf("desired sampling capacity of %d is greater than maximum supported rate %d", perSecond, maxRate)
+	}
+	return &Reservoir{
+		maskedCounter: 0,
+		perSecond:     perSecond,
+	}, nil
+}
+
+// Take returns true when the reservoir has remaining sampling
+// capacity for the current epoch. Take returns false when the
+// reservoir has no remaining sampling capacity for the current
+// epoch. The sampling capacity decrements by one each time
+// Take returns true.
+func (r *Reservoir) Take() bool {
+	now := uint64(time.Now().Unix())
+	counterNewVal := atomic.AddUint64(&r.maskedCounter, 1)
+	previousTimestamp := extractTime(counterNewVal)
+
+	if previousTimestamp != now {
+		r.mutex.Lock()
+		beforeUpdate := atomic.LoadUint64(&r.maskedCounter)
+		timestampBeforeUpdate := extractTime(beforeUpdate)
+
+		if timestampBeforeUpdate != now {
+			valueToSet := timestampToCounter(now)
+			atomic.StoreUint64(&r.maskedCounter, valueToSet)
+		}
+
+		counterNewVal = atomic.AddUint64(&r.maskedCounter, 1)
+		r.mutex.Unlock()
+	}
+
+	newCounterValue := extractCounter(counterNewVal)
+	return newCounterValue <= r.perSecond
+}
+
+func extractTime(maskedCounter uint64) uint64 {
+	return maskedCounter / maxRate
+}
+
+func extractCounter(maskedCounter uint64) uint64 {
+	return maskedCounter % maxRate
+}
+
+func timestampToCounter(timestamp uint64) uint64 {
+	return timestamp * maxRate
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/sampling_rule.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/sampling_rule.go
new file mode 100644
index 00000000..ab3fb88d
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/sampling_rule.go
@@ -0,0 +1,39 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package sampling
+
+import (
+	"math/rand"
+
+	"github.com/aws/aws-xray-sdk-go/pattern"
+)
+
+// Rule represents a single entry in a sampling ruleset.
+type Rule struct {
+	ServiceName string  `json:"service_name"`
+	HTTPMethod  string  `json:"http_method"`
+	URLPath     string  `json:"url_path"`
+	FixedTarget uint64  `json:"fixed_target"`
+	Rate        float64 `json:"rate"`
+	reservoir   *Reservoir
+}
+
+// AppliesTo returns true when the rule applies to the given parameters
+func (sr *Rule) AppliesTo(serviceName string, path string, method string) bool {
+	return pattern.WildcardMatchCaseInsensitive(sr.ServiceName, serviceName) && pattern.WildcardMatchCaseInsensitive(sr.URLPath, path) && pattern.WildcardMatchCaseInsensitive(sr.HTTPMethod, method)
+}
+
+// Sample returns true when the rule's reservoir is not full or
+// when a randomly generated float is less than the rule's rate
+func (sr *Rule) Sample() bool {
+	if sr.reservoir.Take() {
+		return true
+	}
+	return rand.Float64() < sr.Rate
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/sampling_rule_manifest.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/sampling_rule_manifest.go
new file mode 100644
index 00000000..e604d30d
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/sampling_rule_manifest.go
@@ -0,0 +1,93 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package sampling
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/ioutil"
+)
+
+// RuleManifest represents a full sampling ruleset, with a list of
+// custom rules and default values for incoming requests that do
+// not match any of the provided rules.
+type RuleManifest struct {
+	Version int     `json:"version"`
+	Default *Rule   `json:"default"`
+	Rules   []*Rule `json:"rules"`
+}
+
+// ManifestFromFilePath creates a sampling ruleset from a given filepath fp.
+func ManifestFromFilePath(fp string) (*RuleManifest, error) {
+	b, err := ioutil.ReadFile(fp)
+	if err == nil {
+		s, e := ManifestFromJSONBytes(b)
+		if e != nil {
+			return nil, e
+		}
+		err = processManifest(s)
+		if err != nil {
+			return nil, err
+		}
+		return s, nil
+	}
+	return nil, err
+}
+
+// ManifestFromJSONBytes creates a sampling ruleset from given JSON bytes b.
+func ManifestFromJSONBytes(b []byte) (*RuleManifest, error) {
+	s := &RuleManifest{}
+	err := json.Unmarshal(b, s)
+	if err != nil {
+		return nil, err
+	}
+	err = processManifest(s)
+	if err != nil {
+		return nil, err
+	}
+	return s, nil
+}
+
+// processManifest returns the provided manifest if valid,
+// or an error if the provided manifest is invalid.
+func processManifest(srm *RuleManifest) error {
+	if nil == srm {
+		return errors.New("sampling rule manifest must not be nil")
+	}
+	if 1 != srm.Version {
+		return fmt.Errorf("sampling rule manifest version %d not supported", srm.Version)
+	}
+	if nil == srm.Default {
+		return errors.New("sampling rule manifest must include a default rule")
+	}
+	if "" != srm.Default.URLPath || "" != srm.Default.ServiceName || "" != srm.Default.HTTPMethod {
+		return errors.New("the default rule must not specify values for url_path, service_name, or http_method")
+	}
+	if srm.Default.FixedTarget < 0 || srm.Default.Rate < 0 {
+		return errors.New("the default rule must specify non-negative values for fixed_target and rate")
+	}
+
+	res, err := NewReservoir(srm.Default.FixedTarget)
+	if err != nil {
+		return err
+	}
+	srm.Default.reservoir = res
+
+	if srm.Rules != nil {
+		for _, r := range srm.Rules {
+			res, err := NewReservoir(r.FixedTarget)
+			if err != nil {
+				return err
+			}
+			r.reservoir = res
+		}
+	}
+	return nil
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/sampling_strategy.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/sampling_strategy.go
new file mode 100644
index 00000000..583dfa39
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/strategy/sampling/sampling_strategy.go
@@ -0,0 +1,14 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package sampling
+
+// Strategy provides an interface for implementing trace sampling strategies.
+type Strategy interface {
+	ShouldTrace(serviceName string, path string, method string) bool
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/aws.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/aws.go
new file mode 100644
index 00000000..de19fc30
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/aws.go
@@ -0,0 +1,402 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"net/http/httptrace"
+	"reflect"
+	"strings"
+	"unicode"
+
+	"github.com/aws/aws-sdk-go/aws/client"
+	"github.com/aws/aws-sdk-go/aws/request"
+	"github.com/aws/aws-xray-sdk-go/resources"
+	log "github.com/cihub/seelog"
+)
+
+type jsonMap struct {
+	object interface{}
+}
+
+const (
+	requestKeyword = iota
+	responseKeyword
+)
+
+func beginSubsegment(r *request.Request, name string) {
+	ctx, _ := BeginSubsegment(r.HTTPRequest.Context(), name)
+	r.HTTPRequest = r.HTTPRequest.WithContext(ctx)
+}
+
+func endSubsegment(r *request.Request) {
+	seg := GetSegment(r.HTTPRequest.Context())
+	seg.Close(r.Error)
+	r.HTTPRequest = r.HTTPRequest.WithContext(context.WithValue(r.HTTPRequest.Context(), ContextKey, seg.parent))
+}
+
+var xRayBeforeValidateHandler = request.NamedHandler{
+	Name: "XRayBeforeValidateHandler",
+	Fn: func(r *request.Request) {
+		ctx, opseg := BeginSubsegment(r.HTTPRequest.Context(), r.ClientInfo.ServiceName)
+		opseg.Namespace = "aws"
+		marshalctx, _ := BeginSubsegment(ctx, "marshal")
+
+		r.HTTPRequest = r.HTTPRequest.WithContext(marshalctx)
+		r.HTTPRequest.Header.Set("x-amzn-trace-id", opseg.DownstreamHeader().String())
+	},
+}
+
+var xRayAfterBuildHandler = request.NamedHandler{
+	Name: "XRayAfterBuildHandler",
+	Fn: func(r *request.Request) {
+		endSubsegment(r)
+	},
+}
+
+var xRayBeforeSignHandler = request.NamedHandler{
+	Name: "XRayBeforeSignHandler",
+	Fn: func(r *request.Request) {
+		ctx, _ := BeginSubsegment(r.HTTPRequest.Context(), fmt.Sprintf("attempt_%d", (r.RetryCount+1)))
+
+		ct, _ := NewClientTrace(ctx)
+		r.HTTPRequest = r.HTTPRequest.WithContext(httptrace.WithClientTrace(ctx, ct.httpTrace))
+	},
+}
+
+var xRayAfterSignHandler = request.NamedHandler{
+	Name: "XRayAfterSignHandler",
+	Fn: func(r *request.Request) {
+		endSubsegment(r)
+	},
+}
+
+var xRayBeforeSendHandler = request.NamedHandler{
+	Name: "XRayBeforeSendHandler",
+	Fn: func(r *request.Request) {
+	},
+}
+
+var xRayAfterSendHandler = request.NamedHandler{
+	Name: "XRayAfterSendHandler",
+	Fn: func(r *request.Request) {
+		endSubsegment(r)
+	},
+}
+
+var xRayBeforeUnmarshalHandler = request.NamedHandler{
+	Name: "XRayBeforeUnmarshalHandler",
+	Fn: func(r *request.Request) {
+		endSubsegment(r) // end attempt_x subsegment
+		beginSubsegment(r, "unmarshal")
+	},
+}
+
+var xRayAfterUnmarshalHandler = request.NamedHandler{
+	Name: "XRayAfterUnmarshalHandler",
+	Fn: func(r *request.Request) {
+		endSubsegment(r)
+	},
+}
+
+var xRayBeforeRetryHandler = request.NamedHandler{
+	Name: "XRayBeforeRetryHandler",
+	Fn: func(r *request.Request) {
+		endSubsegment(r) // end attempt_x subsegment
+		ctx, _ := BeginSubsegment(r.HTTPRequest.Context(), "wait")
+
+		r.HTTPRequest = r.HTTPRequest.WithContext(ctx)
+	},
+}
+
+var xRayAfterRetryHandler = request.NamedHandler{
+	Name: "XRayAfterRetryHandler",
+	Fn: func(r *request.Request) {
+		endSubsegment(r)
+	},
+}
+
+func pushHandlers(c *client.Client) {
+	c.Handlers.Validate.PushFrontNamed(xRayBeforeValidateHandler)
+	c.Handlers.Build.PushBackNamed(xRayAfterBuildHandler)
+	c.Handlers.Sign.PushFrontNamed(xRayBeforeSignHandler)
+	c.Handlers.Unmarshal.PushFrontNamed(xRayBeforeUnmarshalHandler)
+	c.Handlers.Unmarshal.PushBackNamed(xRayAfterUnmarshalHandler)
+	c.Handlers.Retry.PushFrontNamed(xRayBeforeRetryHandler)
+	c.Handlers.AfterRetry.PushBackNamed(xRayAfterRetryHandler)
+}
+
+// AWS adds X-Ray tracing to an AWS client.
+func AWS(c *client.Client) {
+	if c == nil {
+		panic("Please initialize the provided AWS client before passing to the AWS() method.")
+	}
+	pushHandlers(c)
+	c.Handlers.Complete.PushFrontNamed(xrayCompleteHandler(""))
+}
+
+// AWSWithWhitelist allows a custom parameter whitelist JSON file to be defined.
+func AWSWithWhitelist(c *client.Client, filename string) {
+	if c == nil {
+		panic("Please initialize the provided AWS client before passing to the AWSWithWhitelist() method.")
+	}
+	pushHandlers(c)
+	c.Handlers.Complete.PushFrontNamed(xrayCompleteHandler(filename))
+}
+
+func xrayCompleteHandler(filename string) request.NamedHandler {
+	whitelistJSON := parseWhitelistJSON(filename)
+	whitelist := &jsonMap{}
+	err := json.Unmarshal(whitelistJSON, &whitelist.object)
+	if err != nil {
+		panic(err)
+	}
+
+	return request.NamedHandler{
+		Name: "XRayCompleteHandler",
+		Fn: func(r *request.Request) {
+			curseg := GetSegment(r.HTTPRequest.Context())
+
+			for curseg != nil && curseg.Namespace != "aws" {
+				curseg.Close(nil)
+				curseg = curseg.parent
+			}
+			if curseg == nil {
+				return
+			}
+
+			opseg := curseg
+
+			opseg.Lock()
+			for k, v := range extractRequestParameters(r, whitelist) {
+				opseg.GetAWS()[strings.ToLower(addUnderScoreBetweenWords(k))] = v
+			}
+			for k, v := range extractResponseParameters(r, whitelist) {
+				opseg.GetAWS()[strings.ToLower(addUnderScoreBetweenWords(k))] = v
+			}
+
+			opseg.GetAWS()["region"] = r.ClientInfo.SigningRegion
+			opseg.GetAWS()["operation"] = r.Operation.Name
+			opseg.GetAWS()["request_id"] = r.RequestID
+			opseg.GetAWS()["retries"] = r.RetryCount
+
+			if r.HTTPResponse != nil {
+				opseg.GetHTTP().GetResponse().Status = r.HTTPResponse.StatusCode
+				opseg.GetHTTP().GetResponse().ContentLength = int(r.HTTPResponse.ContentLength)
+			}
+
+			if request.IsErrorThrottle(r.Error) {
+				opseg.Throttle = true
+			}
+
+			opseg.Unlock()
+			opseg.Close(r.Error)
+		},
+	}
+}
+
+func parseWhitelistJSON(filename string) []byte {
+	if filename != "" {
+		readBytes, err := ioutil.ReadFile(filename)
+		if err != nil {
+			log.Errorf("Error occurred while reading customized AWS whitelist JSON file. %v \nReverting to default AWS whitelist JSON file.", err)
+		} else {
+			return readBytes
+		}
+	}
+
+	defaultBytes, err := resources.Asset("resources/AWSWhitelist.json")
+	if err != nil {
+		panic(err)
+	}
+	return defaultBytes
+}
+
+func keyValue(r interface{}, tag string) interface{} {
+	v := reflect.ValueOf(r)
+	if v.Kind() == reflect.Ptr {
+		v = v.Elem()
+	}
+	if v.Kind() != reflect.Struct {
+		log.Errorf("keyValue only accepts structs; got %T", v)
+	}
+	typ := v.Type()
+	for i := 1; i < v.NumField(); i++ {
+		if typ.Field(i).Name == tag {
+			return v.Field(i).Interface()
+		}
+	}
+	return nil
+}
+
+func addUnderScoreBetweenWords(name string) string {
+	var buffer bytes.Buffer
+	for i, char := range name {
+		if unicode.IsUpper(char) && i != 0 {
+			buffer.WriteRune('_')
+		}
+		buffer.WriteRune(char)
+	}
+	return buffer.String()
+}
+
+func (j *jsonMap) data() interface{} {
+	if j == nil {
+		return nil
+	}
+	return j.object
+}
+
+func (j *jsonMap) search(keys ...string) *jsonMap {
+	var object interface{}
+	object = j.data()
+
+	for target := 0; target < len(keys); target++ {
+		if mmap, ok := object.(map[string]interface{}); ok {
+			object, ok = mmap[keys[target]]
+			if !ok {
+				return nil
+			}
+		} else {
+			return nil
+		}
+	}
+	return &jsonMap{object}
+}
+
+func (j *jsonMap) children() ([]interface{}, error) {
+	if slice, ok := j.data().([]interface{}); ok {
+		return slice, nil
+	}
+	return nil, errors.New("cannot get corresponding items for given aws whitelisting json file")
+}
+
+func (j *jsonMap) childrenMap() (map[string]interface{}, error) {
+	if mmap, ok := j.data().(map[string]interface{}); ok {
+		return mmap, nil
+	}
+	return nil, errors.New("cannot get corresponding items for given aws whitelisting json file")
+}
+
+func extractRequestParameters(r *request.Request, whitelist *jsonMap) map[string]interface{} {
+	valueMap := make(map[string]interface{})
+
+	extractParameters("request_parameters", requestKeyword, r, whitelist, valueMap)
+	extractDescriptors("request_descriptors", requestKeyword, r, whitelist, valueMap)
+
+	return valueMap
+}
+
+func extractResponseParameters(r *request.Request, whitelist *jsonMap) map[string]interface{} {
+	valueMap := make(map[string]interface{})
+
+	extractParameters("response_parameters", responseKeyword, r, whitelist, valueMap)
+	extractDescriptors("response_descriptors", responseKeyword, r, whitelist, valueMap)
+
+	return valueMap
+}
+
+func extractParameters(whitelistKey string, rType int, r *request.Request, whitelist *jsonMap, valueMap map[string]interface{}) {
+	params := whitelist.search("services", r.ClientInfo.ServiceName, "operations", r.Operation.Name, whitelistKey)
+	if params != nil {
+		children, err := params.children()
+		if err != nil {
+			log.Errorf("failed to get values for aws attribute: %v", err)
+			return
+		}
+		for _, child := range children {
+			if child != nil {
+				var value interface{}
+				if rType == requestKeyword {
+					value = keyValue(r.Params, child.(string))
+				} else if rType == responseKeyword {
+					value = keyValue(r.Data, child.(string))
+				}
+				if (value != reflect.Value{}) {
+					valueMap[child.(string)] = value
+				}
+			}
+		}
+	}
+}
+
+func extractDescriptors(whitelistKey string, rType int, r *request.Request, whitelist *jsonMap, valueMap map[string]interface{}) {
+	responseDtr := whitelist.search("services", r.ClientInfo.ServiceName, "operations", r.Operation.Name, whitelistKey)
+	if responseDtr != nil {
+		items, err := responseDtr.childrenMap()
+		if err != nil {
+			log.Errorf("failed to get values for aws attribute: %v", err)
+			return
+		}
+		for k := range items {
+			descriptorMap, _ := whitelist.search("services", r.ClientInfo.ServiceName, "operations", r.Operation.Name, whitelistKey, k).childrenMap()
+			if rType == requestKeyword {
+				insertDescriptorValuesIntoMap(k, r.Params, descriptorMap, valueMap)
+			} else if rType == responseKeyword {
+				insertDescriptorValuesIntoMap(k, r.Data, descriptorMap, valueMap)
+			}
+		}
+	}
+}
+
+func descriptorType(descriptorMap map[string]interface{}) string {
+	var typeValue string
+	if (descriptorMap["map"] != nil) && (descriptorMap["get_keys"] != nil) {
+		typeValue = "map"
+	} else if (descriptorMap["list"] != nil) && (descriptorMap["get_count"] != nil) {
+		typeValue = "list"
+	} else if descriptorMap["value"] != nil {
+		typeValue = "value"
+	} else {
+		log.Error("Missing keys in request / response descriptors in AWS whitelist JSON file.")
+	}
+	return typeValue
+}
+
+func insertDescriptorValuesIntoMap(key string, data interface{}, descriptorMap map[string]interface{}, valueMap map[string]interface{}) {
+	descriptorType := descriptorType(descriptorMap)
+	if descriptorType == "map" {
+		var keySlice []interface{}
+		m := keyValue(data, key)
+		val := reflect.ValueOf(m)
+		if val.Kind() == reflect.Map {
+			for _, key := range val.MapKeys() {
+				keySlice = append(keySlice, key.Interface())
+			}
+		}
+		if descriptorMap["rename_to"] != nil {
+			valueMap[descriptorMap["rename_to"].(string)] = keySlice
+		} else {
+			valueMap[strings.ToLower(key)] = keySlice
+		}
+	} else if descriptorType == "list" {
+		var count int
+		l := keyValue(data, key)
+		val := reflect.ValueOf(l)
+		count = val.Len()
+
+		if descriptorMap["rename_to"] != nil {
+			valueMap[descriptorMap["rename_to"].(string)] = count
+		} else {
+			valueMap[strings.ToLower(key)] = count
+		}
+	} else if descriptorType == "value" {
+		val := keyValue(data, key)
+		if descriptorMap["rename_to"] != nil {
+			valueMap[descriptorMap["rename_to"].(string)] = val
+		} else {
+			valueMap[strings.ToLower(key)] = val
+		}
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/capture.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/capture.go
new file mode 100644
index 00000000..f23cc476
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/capture.go
@@ -0,0 +1,56 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+import (
+	"context"
+	"fmt"
+)
+
+// Capture traces the provided synchronous function by
+// beginning and closing a subsegment around its execution.
+func Capture(ctx context.Context, name string, fn func(context.Context) error) (err error) {
+	c, seg := BeginSubsegment(ctx, name)
+
+	defer func() {
+		if seg != nil {
+			seg.Close(err)
+
+		} else {
+			privateCfg.ContextMissingStrategy().ContextMissing(fmt.Sprintf("failed to end subsegment: subsegment '%v' cannot be found.", name))
+		}
+	}()
+
+	defer func() {
+		if p := recover(); p != nil {
+			err = privateCfg.ExceptionFormattingStrategy().Panicf("%v", p)
+			panic(p)
+		}
+	}()
+
+	if c == nil && seg == nil {
+		err = fn(ctx)
+	} else {
+		err = fn(c)
+	}
+
+	return err
+}
+
+// CaptureAsync traces an arbitrary code segment within a goroutine.
+// Use CaptureAsync instead of manually calling Capture within a goroutine
+// to ensure the segment is flushed properly.
+func CaptureAsync(ctx context.Context, name string, fn func(context.Context) error) {
+	started := make(chan struct{})
+	go Capture(ctx, name, func(ctx context.Context) error {
+		close(started)
+		return fn(ctx)
+	})
+	<-started
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/client.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/client.go
new file mode 100644
index 00000000..e9844654
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/client.go
@@ -0,0 +1,99 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptrace"
+	"strconv"
+	log "github.com/cihub/seelog"
+)
+
+// Client creates a shallow copy of the provided http client,
+// defaulting to http.DefaultClient, with roundtripper wrapped
+// with xray.RoundTripper.
+func Client(c *http.Client) *http.Client {
+	if c == nil {
+		c = http.DefaultClient
+	}
+	transport := c.Transport
+	if transport == nil {
+		transport = http.DefaultTransport
+	}
+	return &http.Client{
+		Transport:     RoundTripper(transport),
+		CheckRedirect: c.CheckRedirect,
+		Jar:           c.Jar,
+		Timeout:       c.Timeout,
+	}
+}
+
+// RoundTripper wraps the provided http roundtripper with xray.Capture,
+// sets HTTP-specific xray fields, and adds the trace header to the outbound request.
+func RoundTripper(rt http.RoundTripper) http.RoundTripper {
+	return &roundtripper{rt}
+}
+
+type roundtripper struct {
+	Base http.RoundTripper
+}
+
+// RoundTrip wraps a single HTTP transaction and add corresponding information into a subsegment.
+func (rt *roundtripper) RoundTrip(r *http.Request) (*http.Response, error) {
+	var resp *http.Response
+	err := Capture(r.Context(), r.Host, func(ctx context.Context) error {
+		var err error
+		seg := GetSegment(ctx)
+		if seg == nil {
+			resp, err = rt.Base.RoundTrip(r)
+			log.Warnf("failed to record HTTP transaction: segment cannot be found.")
+			return err
+		}
+		
+		ct, e := NewClientTrace(ctx)
+		if e != nil {
+			return e
+		}
+		r = r.WithContext(httptrace.WithClientTrace(ctx, ct.httpTrace))
+
+		seg.Lock()
+		seg.Namespace = "remote"
+		seg.GetHTTP().GetRequest().Method = r.Method
+		seg.GetHTTP().GetRequest().URL = r.URL.String()
+
+		r.Header.Set("x-amzn-trace-id", seg.DownstreamHeader().String())
+		seg.Unlock()
+
+		resp, err = rt.Base.RoundTrip(r)
+
+		if resp != nil {
+			seg.Lock()
+			seg.GetHTTP().GetResponse().Status = resp.StatusCode
+			seg.GetHTTP().GetResponse().ContentLength, _ = strconv.Atoi(resp.Header.Get("Content-Length"))
+
+			if resp.StatusCode >= 400 && resp.StatusCode < 500 {
+				seg.Error = true
+			}
+			if resp.StatusCode == 429 {
+				seg.Throttle = true
+			}
+			if resp.StatusCode >= 500 && resp.StatusCode < 600 {
+				seg.Fault = true
+			}
+			seg.Unlock()
+		}
+		if err != nil {
+			ct.subsegments.GotConn(nil, err)
+		}
+
+		return err
+	})
+	return resp, err
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/config.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/config.go
new file mode 100644
index 00000000..fefa5113
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/config.go
@@ -0,0 +1,231 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+import (
+	"fmt"
+	"net"
+	"os"
+	"sync"
+
+	"github.com/aws/aws-xray-sdk-go/strategy/ctxmissing"
+	"github.com/aws/aws-xray-sdk-go/strategy/exception"
+	"github.com/aws/aws-xray-sdk-go/strategy/sampling"
+	log "github.com/cihub/seelog"
+)
+
+var privateCfg = newPrivateConfig()
+
+func newPrivateConfig() *privateConfig {
+	ret := &privateConfig{
+		daemonAddr: &net.UDPAddr{
+			IP:   net.IPv4(127, 0, 0, 1),
+			Port: 2000,
+		},
+		logLevel:  log.InfoLvl,
+		logFormat: "%Date(2006-01-02T15:04:05Z07:00) [%Level] %Msg%n",
+	}
+
+	ss, err := sampling.NewLocalizedStrategy()
+	if err != nil {
+		panic(err)
+	}
+	ret.samplingStrategy = ss
+
+	efs, err := exception.NewDefaultFormattingStrategy()
+	if err != nil {
+		panic(err)
+	}
+	ret.exceptionFormattingStrategy = efs
+
+	sts, err := NewDefaultStreamingStrategy()
+	if err != nil {
+		panic(err)
+	}
+	ret.streamingStrategy = sts
+
+	cm := ctxmissing.NewDefaultRuntimeErrorStrategy()
+
+	ret.contextMissingStrategy = cm
+
+	return ret
+}
+
+type privateConfig struct {
+	sync.RWMutex
+
+	daemonAddr                  *net.UDPAddr
+	serviceVersion              string
+	samplingStrategy            sampling.Strategy
+	streamingStrategy           StreamingStrategy
+	exceptionFormattingStrategy exception.FormattingStrategy
+	contextMissingStrategy      ctxmissing.Strategy
+	logLevel                    log.LogLevel
+	logFormat                   string
+}
+
+// Config is a set of X-Ray configurations.
+type Config struct {
+	DaemonAddr                  string
+	ServiceVersion              string
+	SamplingStrategy            sampling.Strategy
+	StreamingStrategy           StreamingStrategy
+	ExceptionFormattingStrategy exception.FormattingStrategy
+	ContextMissingStrategy      ctxmissing.Strategy
+	LogLevel                    string
+	LogFormat                   string
+}
+
+// Configure overrides default configuration options with customer-defined values.
+func Configure(c Config) error {
+	privateCfg.Lock()
+	defer privateCfg.Unlock()
+
+	var errors exception.MultiError
+
+	var daemonAddress string
+	if addr := os.Getenv("AWS_XRAY_DAEMON_ADDRESS"); addr != "" {
+		daemonAddress = addr
+	} else if c.DaemonAddr != "" {
+		daemonAddress = c.DaemonAddr
+	}
+
+	if daemonAddress != "" {
+		addr, err := net.ResolveUDPAddr("udp", daemonAddress)
+		if err == nil {
+			privateCfg.daemonAddr = addr
+			go refreshEmitter()
+		} else {
+			errors = append(errors, err)
+		}
+	}
+
+	if c.SamplingStrategy != nil {
+		privateCfg.samplingStrategy = c.SamplingStrategy
+	}
+
+	if c.ExceptionFormattingStrategy != nil {
+		privateCfg.exceptionFormattingStrategy = c.ExceptionFormattingStrategy
+	}
+
+	if c.StreamingStrategy != nil {
+		privateCfg.streamingStrategy = c.StreamingStrategy
+	}
+
+	cms := os.Getenv("AWS_XRAY_CONTEXT_MISSING")
+	if cms != "" {
+		if cms == ctxmissing.RuntimeErrorStrategy {
+			cm := ctxmissing.NewDefaultRuntimeErrorStrategy()
+			privateCfg.contextMissingStrategy = cm
+		} else if cms == ctxmissing.LogErrorStrategy {
+			cm := ctxmissing.NewDefaultLogErrorStrategy()
+			privateCfg.contextMissingStrategy = cm
+		}
+	} else if c.ContextMissingStrategy != nil {
+		privateCfg.contextMissingStrategy = c.ContextMissingStrategy
+	}
+
+	if c.ServiceVersion != "" {
+		privateCfg.serviceVersion = c.ServiceVersion
+	}
+
+	privateCfg.logLevel, privateCfg.logFormat = loadLogConfig(c.LogLevel, c.LogFormat)
+
+	switch len(errors) {
+	case 0:
+		return nil
+	case 1:
+		return errors[0]
+	default:
+		return errors
+	}
+}
+
+func loadLogConfig(logLevel string, logFormat string) (log.LogLevel, string) {
+	var level log.LogLevel
+	var format string
+
+	switch logLevel {
+	case "trace":
+		level = log.TraceLvl
+	case "debug":
+		level = log.DebugLvl
+	case "info":
+		level = log.InfoLvl
+	case "warn":
+		level = log.WarnLvl
+	case "error":
+		level = log.ErrorLvl
+	default:
+		level = log.InfoLvl
+		logLevel = "info"
+	}
+
+	if logFormat != "" {
+		format = logFormat
+	} else {
+		format = "%Date(2006-01-02T15:04:05Z07:00) [%Level] %Msg%n"
+	}
+
+	writer, _ := log.NewConsoleWriter()
+	logger, err := log.LoggerFromWriterWithMinLevelAndFormat(writer, level, format)
+	if err != nil {
+		panic(fmt.Errorf("failed to create logs as StdOut: %v", err))
+	}
+	log.ReplaceLogger(logger)
+	return level, format
+}
+
+func (c *privateConfig) DaemonAddr() *net.UDPAddr {
+	c.RLock()
+	defer c.RUnlock()
+	return c.daemonAddr
+}
+
+func (c *privateConfig) SamplingStrategy() sampling.Strategy {
+	c.RLock()
+	defer c.RUnlock()
+	return c.samplingStrategy
+}
+
+func (c *privateConfig) StreamingStrategy() StreamingStrategy {
+	c.RLock()
+	defer c.RUnlock()
+	return c.streamingStrategy
+}
+
+func (c *privateConfig) ExceptionFormattingStrategy() exception.FormattingStrategy {
+	c.RLock()
+	defer c.RUnlock()
+	return c.exceptionFormattingStrategy
+}
+
+func (c *privateConfig) ContextMissingStrategy() ctxmissing.Strategy {
+	c.RLock()
+	defer c.RUnlock()
+	return c.contextMissingStrategy
+}
+
+func (c *privateConfig) ServiceVersion() string {
+	c.RLock()
+	defer c.RUnlock()
+	return c.serviceVersion
+}
+
+func (c *privateConfig) LogLevel() log.LogLevel {
+	c.RLock()
+	defer c.RUnlock()
+	return c.logLevel
+}
+
+func (c *privateConfig) LogFormat() string {
+	c.RLock()
+	defer c.RUnlock()
+	return c.logFormat
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/context.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/context.go
new file mode 100644
index 00000000..abd5a782
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/context.go
@@ -0,0 +1,95 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+import (
+	"context"
+	"errors"
+)
+
+// ContextKeytype defines integer to be type of ContextKey.
+type ContextKeytype int
+
+// ContextKey returns a pointer to a newly allocated zero value of ContextKeytype.
+var ContextKey = new(ContextKeytype)
+
+// ErrRetrieveSegment happens when a segment cannot be retrieved
+var ErrRetrieveSegment = errors.New("unable to retrieve segment")
+
+// GetSegment returns a pointer to the segment or subsegment provided
+// in ctx, or nil if no segment or subsegment is found.
+func GetSegment(ctx context.Context) *Segment {
+	if seg, ok := ctx.Value(ContextKey).(*Segment); ok {
+		return seg
+	}
+	return nil
+}
+
+// TraceID returns the canonical ID of the cross-service trace from the
+// given segment in ctx. The value can be used in X-Ray's UI to uniquely
+// identify the code paths executed. If no segment is provided in ctx,
+// an empty string is returned.
+func TraceID(ctx context.Context) string {
+	if seg, ok := ctx.Value(ContextKey).(*Segment); ok {
+		return seg.TraceID
+	}
+	return ""
+}
+
+// RequestWasTraced returns true if the context contains an X-Ray segment
+// that was created from an HTTP request that contained a trace header.
+// This is useful to ensure that a service is only called from X-Ray traced
+// services.
+func RequestWasTraced(ctx context.Context) bool {
+	for seg := GetSegment(ctx); seg != nil; seg = seg.parent {
+		if seg.RequestWasTraced {
+			return true
+		}
+	}
+	return false
+}
+
+// DetachContext returns a new context with the existing segment.
+// This is useful for creating background tasks which won't be cancelled
+// when a request completes.
+func DetachContext(ctx context.Context) context.Context {
+	return context.WithValue(context.Background(), ContextKey, GetSegment(ctx))
+}
+
+// AddAnnotation adds an annotation to the provided segment or subsegment in ctx.
+func AddAnnotation(ctx context.Context, key string, value interface{}) error {
+	if seg := GetSegment(ctx); seg != nil {
+		return seg.AddAnnotation(key, value)
+	}
+	return ErrRetrieveSegment
+}
+
+// AddMetadata adds a metadata to the provided segment or subsegment in ctx.
+func AddMetadata(ctx context.Context, key string, value interface{}) error {
+	if seg := GetSegment(ctx); seg != nil {
+		return seg.AddMetadata(key, value)
+	}
+	return ErrRetrieveSegment
+}
+
+// AddMetadataToNamespace adds a namespace to the provided segment's or subsegment's metadata in ctx.
+func AddMetadataToNamespace(ctx context.Context, namespace string, key string, value interface{}) error {
+	if seg := GetSegment(ctx); seg != nil {
+		return seg.AddMetadataToNamespace(namespace, key, value)
+	}
+	return ErrRetrieveSegment
+}
+
+// AddError adds an error to the provided segment or subsegment in ctx.
+func AddError(ctx context.Context, err error) error {
+	if seg := GetSegment(ctx); seg != nil {
+		return seg.AddError(err)
+	}
+	return ErrRetrieveSegment
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/default_streaming_strategy.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/default_streaming_strategy.go
new file mode 100644
index 00000000..0b8fb3fb
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/default_streaming_strategy.go
@@ -0,0 +1,85 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+import (
+	"encoding/json"
+	"errors"
+
+	log "github.com/cihub/seelog"
+)
+
+var defaultMaxSubsegmentCount = 20
+
+// DefaultStreamingStrategy provides a default value of 20
+// for the maximum number of subsegments that can be emitted
+// in a single UDP packet.
+type DefaultStreamingStrategy struct {
+	MaxSubsegmentCount int
+}
+
+// NewDefaultStreamingStrategy initializes and returns a
+// pointer to an instance of DefaultStreamingStrategy.
+func NewDefaultStreamingStrategy() (*DefaultStreamingStrategy, error) {
+	return &DefaultStreamingStrategy{MaxSubsegmentCount: defaultMaxSubsegmentCount}, nil
+}
+
+// NewDefaultStreamingStrategyWithMaxSubsegmentCount initializes
+// and returns a pointer to an instance of DefaultStreamingStrategy
+// with a custom maximum number of subsegments per UDP packet.
+func NewDefaultStreamingStrategyWithMaxSubsegmentCount(maxSubsegmentCount int) (*DefaultStreamingStrategy, error) {
+	if maxSubsegmentCount <= 0 {
+		return nil, errors.New("maxSubsegmentCount must be a non-negative integer")
+	}
+	return &DefaultStreamingStrategy{MaxSubsegmentCount: maxSubsegmentCount}, nil
+}
+
+// RequiresStreaming returns true when the number of subsegment
+// children for a given segment is larger than MaxSubsegmentCount.
+func (dSS *DefaultStreamingStrategy) RequiresStreaming(seg *Segment) bool {
+	if seg.ParentSegment.Sampled {
+		return seg.ParentSegment.totalSubSegments > dSS.MaxSubsegmentCount
+	}
+	return false
+}
+
+// StreamCompletedSubsegments separates subsegments from the provided
+// segment tree and sends them to daemon as streamed subsegment UDP packets.
+func (dSS *DefaultStreamingStrategy) StreamCompletedSubsegments(seg *Segment) [][]byte {
+	log.Trace("Beginning to stream subsegments.")
+	var outSegments [][]byte
+	for i := 0; i < len(seg.rawSubsegments); i++ {
+		child := seg.rawSubsegments[i]
+		seg.rawSubsegments[i] = seg.rawSubsegments[len(seg.rawSubsegments)-1]
+		seg.rawSubsegments[len(seg.rawSubsegments)-1] = nil
+		seg.rawSubsegments = seg.rawSubsegments[:len(seg.rawSubsegments)-1]
+
+		seg.Subsegments[i] = seg.Subsegments[len(seg.Subsegments)-1]
+		seg.Subsegments[len(seg.Subsegments)-1] = nil
+		seg.Subsegments = seg.Subsegments[:len(seg.Subsegments)-1]
+
+		seg.ParentSegment.totalSubSegments--
+
+		// Add extra information into child subsegment
+		child.Lock()
+		child.TraceID = seg.root().TraceID
+		child.ParentID = seg.ID
+		child.Type = "subsegment"
+		child.parent = nil
+		child.RequestWasTraced = seg.RequestWasTraced
+		cb, _ := json.Marshal(child)
+		outSegments = append(outSegments, cb)
+		log.Tracef("Streaming subsegment named '%s' from segment tree.", child.Name)
+		child.Unlock()
+
+		break
+	}
+	log.Trace("Finished streaming subsegments.")
+	return outSegments
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/emitter.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/emitter.go
new file mode 100644
index 00000000..cfb381b3
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/emitter.go
@@ -0,0 +1,89 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+import (
+	"bytes"
+	"encoding/json"
+	"net"
+	"sync"
+
+	log "github.com/cihub/seelog"
+)
+
+// Header is added before sending segments to daemon.
+var Header = []byte(`{"format": "json", "version": 1}` + "\n")
+
+type emitter struct {
+	sync.Mutex
+	conn *net.UDPConn
+}
+
+var e = &emitter{}
+
+func init() {
+	refreshEmitter()
+}
+
+func refreshEmitter() {
+	e.Lock()
+	e.conn, _ = net.DialUDP("udp", nil, privateCfg.DaemonAddr())
+	e.Unlock()
+}
+
+func emit(seg *Segment) {
+	if seg == nil || !seg.Sampled {
+		return
+	}
+
+	for _, p := range packSegments(seg, nil) {
+		if privateCfg.LogLevel() <= log.TraceLvl {
+			b := &bytes.Buffer{}
+			json.Indent(b, p, "", " ")
+			log.Trace(b.String())
+		}
+		e.Lock()
+		_, err := e.conn.Write(append(Header, p...))
+		if err != nil {
+			log.Error(err)
+		}
+		e.Unlock()
+	}
+}
+
+func packSegments(seg *Segment, outSegments [][]byte) [][]byte {
+	seg.Lock()
+	defer seg.Unlock()
+
+	trimSubsegment := func(s *Segment) []byte {
+		ss := privateCfg.StreamingStrategy()
+		for ss.RequiresStreaming(s) {
+			if len(s.rawSubsegments) == 0 {
+				break
+			}
+			cb := ss.StreamCompletedSubsegments(s)
+			outSegments = append(outSegments, cb...)
+		}
+		b, _ := json.Marshal(s)
+		return b
+	}
+
+	for _, s := range seg.rawSubsegments {
+		outSegments = packSegments(s, outSegments)
+		if b := trimSubsegment(s); b != nil {
+			seg.Subsegments = append(seg.Subsegments, b)
+		}
+	}
+	if seg.parent == nil {
+		if b := trimSubsegment(seg); b != nil {
+			outSegments = append(outSegments, b)
+		}
+	}
+	return outSegments
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/handler.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/handler.go
new file mode 100644
index 00000000..b53d885f
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/handler.go
@@ -0,0 +1,200 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+import (
+	"bytes"
+	"net/http"
+	"os"
+	"strconv"
+	"strings"
+
+	"github.com/aws/aws-xray-sdk-go/header"
+	"github.com/aws/aws-xray-sdk-go/pattern"
+	log "github.com/cihub/seelog"
+)
+
+// SegmentNamer is the interface for naming service node.
+type SegmentNamer interface {
+	Name(host string) string
+}
+
+// FixedSegmentNamer records the fixed name of service node.
+type FixedSegmentNamer struct {
+	FixedName string
+}
+
+// NewFixedSegmentNamer initializes a FixedSegmentNamer which
+// will provide a fixed segment name for every generated segment.
+// If the AWS_XRAY_TRACING_NAME environment variable is set,
+// its value will override the provided name argument.
+func NewFixedSegmentNamer(name string) *FixedSegmentNamer {
+	if fName := os.Getenv("AWS_XRAY_TRACING_NAME"); fName != "" {
+		name = fName
+	}
+	return &FixedSegmentNamer{
+		FixedName: name,
+	}
+}
+
+// Name returns the segment name for the given host header value.
+// In this case, FixedName is always returned.
+func (fSN *FixedSegmentNamer) Name(host string) string {
+	return fSN.FixedName
+}
+
+// DynamicSegmentNamer chooses names for segments generated
+// for incoming requests by parsing the HOST header of the
+// incoming request. If the host header matches a given
+// recognized pattern (using the included pattern package),
+// it is used as the segment name. Otherwise, the fallback
+// name is used.
+type DynamicSegmentNamer struct {
+	FallbackName    string
+	RecognizedHosts string
+}
+
+// NewDynamicSegmentNamer creates a new dynamic segment namer.
+func NewDynamicSegmentNamer(fallback string, recognized string) *DynamicSegmentNamer {
+	if dName := os.Getenv("AWS_XRAY_TRACING_NAME"); dName != "" {
+		fallback = dName
+	}
+	return &DynamicSegmentNamer{
+		FallbackName:    fallback,
+		RecognizedHosts: recognized,
+	}
+}
+
+// Name returns the segment name for the given host header value.
+func (dSN *DynamicSegmentNamer) Name(host string) string {
+	if pattern.WildcardMatchCaseInsensitive(dSN.RecognizedHosts, host) {
+		return host
+	}
+	return dSN.FallbackName
+}
+
+// Handler wraps the provided http handler with xray.Capture
+// using the request's context, parsing the incoming headers,
+// adding response headers if needed, and sets HTTP sepecific trace fields.
+// Handler names the generated segments using the provided SegmentNamer.
+func Handler(sn SegmentNamer, h http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		name := sn.Name(r.Host)
+
+		traceHeader := header.FromString(r.Header.Get("x-amzn-trace-id"))
+
+		ctx, seg := NewSegmentFromHeader(r.Context(), name, traceHeader)
+
+		r = r.WithContext(ctx)
+
+		seg.Lock()
+
+		seg.GetHTTP().GetRequest().Method = r.Method
+		seg.GetHTTP().GetRequest().URL = r.URL.String()
+		seg.GetHTTP().GetRequest().ClientIP, seg.GetHTTP().GetRequest().XForwardedFor = clientIP(r)
+		seg.GetHTTP().GetRequest().UserAgent = r.UserAgent()
+
+		trace := parseHeaders(r.Header)
+		if trace["Root"] != "" {
+			seg.TraceID = trace["Root"]
+			seg.RequestWasTraced = true
+		}
+		if trace["Parent"] != "" {
+			seg.ParentID = trace["Parent"]
+		}
+		// Don't use the segment's header here as we only want to
+		// send back the root and possibly sampled values.
+		var respHeader bytes.Buffer
+		respHeader.WriteString("Root=")
+		respHeader.WriteString(seg.TraceID)
+		switch trace["Sampled"] {
+		case "0":
+			seg.Sampled = false
+			log.Trace("Incoming header decided: Sampled=false")
+		case "1":
+			seg.Sampled = true
+			log.Trace("Incoming header decided: Sampled=true")
+		default:
+			seg.Sampled = privateCfg.SamplingStrategy().ShouldTrace(r.Host, r.URL.String(), r.Method)
+			log.Tracef("SamplingStrategy decided: %t", seg.Sampled)
+		}
+		if trace["Sampled"] == "?" {
+			respHeader.WriteString(";Sampled=")
+			respHeader.WriteString(strconv.Itoa(btoi(seg.Sampled)))
+		}
+		w.Header().Set("x-amzn-trace-id", respHeader.String())
+		seg.Unlock()
+
+		resp := &responseCapturer{w, 200, 0}
+		h.ServeHTTP(resp, r)
+
+		seg.Lock()
+		seg.GetHTTP().GetResponse().Status = resp.status
+		seg.GetHTTP().GetResponse().ContentLength, _ = strconv.Atoi(resp.Header().Get("Content-Length"))
+
+		if resp.status >= 400 && resp.status < 500 {
+			seg.Error = true
+		}
+		if resp.status == 429 {
+			seg.Throttle = true
+		}
+		if resp.status >= 500 && resp.status < 600 {
+			seg.Fault = true
+		}
+		seg.Unlock()
+		seg.Close(nil)
+	})
+}
+
+func clientIP(r *http.Request) (string, bool) {
+	forwardedFor := r.Header.Get("X-Forwarded-For")
+	if forwardedFor != "" {
+		return strings.TrimSpace(strings.Split(forwardedFor, ",")[0]), true
+	}
+
+	return r.RemoteAddr, false
+}
+
+type responseCapturer struct {
+	http.ResponseWriter
+	status int
+	length int
+}
+
+func (w *responseCapturer) WriteHeader(status int) {
+	w.status = status
+	w.ResponseWriter.WriteHeader(status)
+}
+
+func (w *responseCapturer) Write(data []byte) (int, error) {
+	w.length += len(data)
+	return w.ResponseWriter.Write(data)
+}
+
+func btoi(b bool) int {
+	if b {
+		return 1
+	}
+	return 0
+}
+
+func parseHeaders(h http.Header) map[string]string {
+	m := map[string]string{}
+	s := h.Get("x-amzn-trace-id")
+	for _, c := range strings.Split(s, ";") {
+		p := strings.SplitN(c, "=", 2)
+		k := strings.TrimSpace(p[0])
+		v := ""
+		if len(p) > 1 {
+			v = strings.TrimSpace(p[1])
+		}
+		m[k] = v
+	}
+	return m
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/httptrace.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/httptrace.go
new file mode 100644
index 00000000..22f0ad17
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/httptrace.go
@@ -0,0 +1,209 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"net/http/httptrace"
+)
+
+type HTTPSubsegments struct {
+	opCtx       context.Context
+	connCtx     context.Context
+	dnsCtx      context.Context
+	connectCtx  context.Context
+	tlsCtx      context.Context
+	reqCtx      context.Context
+	responseCtx context.Context
+}
+
+// GetConn begins a connect subsegment if the HTTP operation
+// subsegment is still in progress.
+func (xt *HTTPSubsegments) GetConn(hostPort string) {
+	if GetSegment(xt.opCtx).InProgress {
+		xt.connCtx, _ = BeginSubsegment(xt.opCtx, "connect")
+	}
+}
+
+// DNSStart begins a dns subsegment if the HTTP operation
+// subsegment is still in progress.
+func (xt *HTTPSubsegments) DNSStart(info httptrace.DNSStartInfo) {
+	if GetSegment(xt.opCtx).InProgress {
+		xt.dnsCtx, _ = BeginSubsegment(xt.connCtx, "dns")
+	}
+}
+
+// DNSDone closes the dns subsegment if the HTTP operation
+// subsegment is still in progress, passing the error value
+// (if any). Information about the address values looked up,
+// and whether or not the call was coalesced is added as
+// metadata to the dns subsegment.
+func (xt *HTTPSubsegments) DNSDone(info httptrace.DNSDoneInfo) {
+	if xt.dnsCtx != nil && GetSegment(xt.opCtx).InProgress {
+		metadata := make(map[string]interface{})
+		metadata["addresses"] = info.Addrs
+		metadata["coalesced"] = info.Coalesced
+
+		AddMetadataToNamespace(xt.dnsCtx, "http", "dns", metadata)
+		GetSegment(xt.dnsCtx).Close(info.Err)
+	}
+}
+
+// ConnectStart begins a dial subsegment if the HTTP operation
+// subsegment is still in progress.
+func (xt *HTTPSubsegments) ConnectStart(network, addr string) {
+	if GetSegment(xt.opCtx).InProgress {
+		xt.connectCtx, _ = BeginSubsegment(xt.connCtx, "dial")
+	}
+}
+
+// ConnectDone closes the dial subsegment if the HTTP operation
+// subsegment is still in progress, passing the error value
+// (if any). Information about the network over which the dial
+// was made is added as metadata to the subsegment.
+func (xt *HTTPSubsegments) ConnectDone(network, addr string, err error) {
+	if xt.connectCtx != nil && GetSegment(xt.opCtx).InProgress {
+		metadata := make(map[string]interface{})
+		metadata["network"] = network
+
+		AddMetadataToNamespace(xt.connectCtx, "http", "connect", metadata)
+		GetSegment(xt.connectCtx).Close(err)
+	}
+}
+
+// TLSHandshakeStart begins a tls subsegment if the HTTP operation
+// subsegment is still in progress.
+func (xt *HTTPSubsegments) TLSHandshakeStart() {
+	if GetSegment(xt.opCtx).InProgress {
+		xt.tlsCtx, _ = BeginSubsegment(xt.connCtx, "tls")
+	}
+}
+
+// TLSHandshakeDone closes the tls subsegment if the HTTP
+// operation subsegment is still in progress, passing the
+// error value(if any). Information about the tls connection
+// is added as metadata to the subsegment.
+func (xt *HTTPSubsegments) TLSHandshakeDone(connState tls.ConnectionState, err error) {
+	if xt.tlsCtx != nil && GetSegment(xt.opCtx).InProgress {
+		metadata := make(map[string]interface{})
+		metadata["did_resume"] = connState.DidResume
+		metadata["negotiated_protocol"] = connState.NegotiatedProtocol
+		metadata["negotiated_protocol_is_mutual"] = connState.NegotiatedProtocolIsMutual
+		metadata["cipher_suite"] = connState.CipherSuite
+
+		AddMetadataToNamespace(xt.tlsCtx, "http", "tls", metadata)
+		GetSegment(xt.tlsCtx).Close(err)
+	}
+}
+
+// GotConn closes the connect subsegment if the HTTP operation
+// subsegment is still in progress, passing the error value
+// (if any). Information about the connection is added as
+// metadata to the subsegment. If the connection is marked as reused,
+// the connect subsegment is deleted.
+func (xt *HTTPSubsegments) GotConn(info *httptrace.GotConnInfo, err error) {
+	if xt.connCtx != nil && GetSegment(xt.opCtx).InProgress { // GetConn may not have been called (client_test.TestBadRoundTrip)
+		if info != nil {
+			if info.Reused {
+				GetSegment(xt.opCtx).RemoveSubsegment(GetSegment(xt.connCtx))
+			} else {
+				metadata := make(map[string]interface{})
+				metadata["reused"] = info.Reused
+				metadata["was_idle"] = info.WasIdle
+				if info.WasIdle {
+					metadata["idle_time"] = info.IdleTime
+				}
+
+				AddMetadataToNamespace(xt.connCtx, "http", "connection", metadata)
+				GetSegment(xt.connCtx).Close(err)
+			}
+		}
+
+		if err == nil {
+			xt.reqCtx, _ = BeginSubsegment(xt.opCtx, "request")
+		}
+
+	}
+}
+
+// WroteRequest closes the request subsegment if the HTTP operation
+// subsegment is still in progress, passing the error value
+// (if any). The response subsegment is then begun.
+func (xt *HTTPSubsegments) WroteRequest(info httptrace.WroteRequestInfo) {
+	if xt.reqCtx != nil && GetSegment(xt.opCtx).InProgress {
+		GetSegment(xt.reqCtx).Close(info.Err)
+		xt.responseCtx, _ = BeginSubsegment(xt.opCtx, "response")
+	}
+}
+
+// GotFirstResponseByte closes the response subsegment if the HTTP
+// operation subsegment is still in progress.
+func (xt *HTTPSubsegments) GotFirstResponseByte() {
+	if xt.responseCtx != nil && GetSegment(xt.opCtx).InProgress {
+		GetSegment(xt.responseCtx).Close(nil)
+	}
+}
+
+type ClientTrace struct {
+	subsegments *HTTPSubsegments
+	httpTrace   *httptrace.ClientTrace
+}
+
+// NewClientTrace returns an instance of xray.ClientTrace, a wrapper
+// around httptrace.ClientTrace. The ClientTrace implementation will
+// generate subsegments for connection time, DNS lookup time, TLS
+// handshake time, and provides additional information about the HTTP round trip
+func NewClientTrace(opCtx context.Context) (ct *ClientTrace, err error) {
+	if opCtx == nil {
+		return nil, errors.New("opCtx must be non-nil")
+	}
+
+	segs := &HTTPSubsegments{
+		opCtx: opCtx,
+	}
+
+	return &ClientTrace{
+		subsegments: segs,
+		httpTrace: &httptrace.ClientTrace{
+			GetConn: func(hostPort string) {
+				segs.GetConn(hostPort)
+			},
+			DNSStart: func(info httptrace.DNSStartInfo) {
+				segs.DNSStart(info)
+			},
+			DNSDone: func(info httptrace.DNSDoneInfo) {
+				segs.DNSDone(info)
+			},
+			ConnectStart: func(network, addr string) {
+				segs.ConnectStart(network, addr)
+			},
+			ConnectDone: func(network, addr string, err error) {
+				segs.ConnectDone(network, addr, err)
+			},
+			TLSHandshakeStart: func() {
+				segs.TLSHandshakeStart()
+			},
+			TLSHandshakeDone: func(connState tls.ConnectionState, err error) {
+				segs.TLSHandshakeDone(connState, err)
+			},
+			GotConn: func(info httptrace.GotConnInfo) {
+				segs.GotConn(&info, nil)
+			},
+			WroteRequest: func(info httptrace.WroteRequestInfo) {
+				segs.WroteRequest(info)
+			},
+			GotFirstResponseByte: func() {
+				segs.GotFirstResponseByte()
+			},
+		},
+	}, nil
+
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/segment.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/segment.go
new file mode 100644
index 00000000..b3169ea0
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/segment.go
@@ -0,0 +1,275 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+import (
+	"context"
+	"crypto/rand"
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/aws/aws-xray-sdk-go/header"
+	"github.com/aws/aws-xray-sdk-go/internal/plugins"
+	log "github.com/cihub/seelog"
+)
+
+// NewTraceID generates a string format of random trace ID.
+func NewTraceID() string {
+	var r [12]byte
+	_, err := rand.Read(r[:])
+	if err != nil {
+		panic(err)
+	}
+	return fmt.Sprintf("1-%08x-%02x", time.Now().Unix(), r)
+}
+
+// NewSegmentID generates a string format of segment ID.
+func NewSegmentID() string {
+	var r [8]byte
+	_, err := rand.Read(r[:])
+	if err != nil {
+		panic(err)
+	}
+	return fmt.Sprintf("%02x", r)
+}
+
+// BeginSegment creates a Segment for a given name and context.
+func BeginSegment(ctx context.Context, name string) (context.Context, *Segment) {
+	if len(name) > 200 {
+		name = name[:200]
+	}
+	seg := &Segment{parent: nil}
+	log.Tracef("Beginning segment named %s", name)
+	seg.ParentSegment = seg
+
+	seg.Lock()
+	defer seg.Unlock()
+
+	seg.TraceID = NewTraceID()
+	seg.Sampled = true
+	seg.addPlugin(plugins.InstancePluginMetadata)
+	if svcVersion := privateCfg.ServiceVersion(); svcVersion != "" {
+		seg.GetService().Version = svcVersion
+	}
+	seg.ID = NewSegmentID()
+	seg.Name = name
+	seg.StartTime = float64(time.Now().UnixNano()) / float64(time.Second)
+	seg.InProgress = true
+
+	go func() {
+		select {
+		case <-ctx.Done():
+			seg.Lock()
+			seg.ContextDone = true
+			seg.Unlock()
+			if !seg.InProgress && !seg.Emitted {
+				seg.flush(false)
+			}
+		}
+	}()
+
+	return context.WithValue(ctx, ContextKey, seg), seg
+}
+
+// BeginSubsegment creates a subsegment for a given name and context.
+func BeginSubsegment(ctx context.Context, name string) (context.Context, *Segment) {
+	if len(name) > 200 {
+		name = name[:200]
+	}
+	parent := GetSegment(ctx)
+	if parent == nil {
+		privateCfg.ContextMissingStrategy().ContextMissing(fmt.Sprintf("failed to begin subsegment named '%v': segment cannot be found.", name))
+		return nil, nil
+	}
+
+	seg := &Segment{parent: parent}
+	log.Tracef("Beginning subsegment named %s", name)
+	seg.ParentSegment = parent.ParentSegment
+	seg.ParentSegment.totalSubSegments++
+	seg.Lock()
+	defer seg.Unlock()
+
+	parent.Lock()
+	parent.rawSubsegments = append(parent.rawSubsegments, seg)
+	parent.openSegments++
+	parent.Unlock()
+
+	seg.ID = NewSegmentID()
+	seg.Name = name
+	seg.StartTime = float64(time.Now().UnixNano()) / float64(time.Second)
+	seg.InProgress = true
+
+	return context.WithValue(ctx, ContextKey, seg), seg
+}
+
+// NewSegmentFromHeader creates a segment for downstream call and add information to the segment that gets from HTTP header.
+func NewSegmentFromHeader(ctx context.Context, name string, h *header.Header) (context.Context, *Segment) {
+	con, seg := BeginSegment(ctx, name)
+
+	if h.TraceID != "" {
+		seg.TraceID = h.TraceID
+	}
+	if h.ParentID != "" {
+		seg.ParentID = h.ParentID
+	}
+	seg.Sampled = h.SamplingDecision == header.Sampled
+	seg.IncomingHeader = h
+
+	return con, seg
+}
+
+// Close a segment.
+func (seg *Segment) Close(err error) {
+
+	seg.Lock()
+	if seg.parent != nil {
+		log.Tracef("Closing subsegment named %s", seg.Name)
+	} else {
+		log.Tracef("Closing segment named %s", seg.Name)
+	}
+	seg.EndTime = float64(time.Now().UnixNano()) / float64(time.Second)
+	seg.InProgress = false
+	seg.Unlock()
+
+	if err != nil {
+		seg.AddError(err)
+	}
+
+	seg.flush(false)
+}
+
+// RemoveSubsegment removes a subsegment child from a segment or subsegment.
+func (seg *Segment) RemoveSubsegment(remove *Segment) bool {
+	seg.Lock()
+	defer seg.Unlock()
+
+	for i, v := range seg.rawSubsegments {
+		if v == remove {
+			seg.rawSubsegments[i] = seg.rawSubsegments[len(seg.rawSubsegments)-1]
+			seg.rawSubsegments[len(seg.rawSubsegments)-1] = nil
+			seg.rawSubsegments = seg.rawSubsegments[:len(seg.rawSubsegments)-1]
+
+			seg.totalSubSegments--
+			seg.openSegments--
+			return true
+		}
+	}
+	return false
+}
+
+func (seg *Segment) flush(decrement bool) {
+	seg.Lock()
+	if decrement {
+		seg.openSegments--
+	}
+	shouldFlush := (seg.openSegments == 0 && seg.EndTime > 0) || seg.ContextDone
+	seg.Unlock()
+
+	if shouldFlush {
+		if seg.parent == nil {
+			seg.Lock()
+			seg.Emitted = true
+			seg.Unlock()
+			emit(seg)
+		} else {
+			seg.parent.flush(true)
+		}
+	}
+}
+
+func (seg *Segment) root() *Segment {
+	if seg.parent == nil {
+		return seg
+	}
+	return seg.parent.root()
+}
+
+func (seg *Segment) addPlugin(metadata *plugins.PluginMetadata) {
+	//Only called within a seg locked code block
+	if metadata == nil {
+		return
+	}
+
+	if metadata.IdentityDocument != nil {
+		seg.GetAWS()["account_id"] = metadata.IdentityDocument.AccountID
+		seg.GetAWS()["instace_id"] = metadata.IdentityDocument.InstanceID
+		seg.GetAWS()["availability_zone"] = metadata.IdentityDocument.AvailabilityZone
+	}
+
+	if metadata.ECSContainerName != "" {
+		seg.GetAWS()["container"] = metadata.ECSContainerName
+	}
+
+	if metadata.BeanstalkMetadata != nil {
+		seg.GetAWS()["environment"] = metadata.BeanstalkMetadata.Environment
+		seg.GetAWS()["version_label"] = metadata.BeanstalkMetadata.VersionLabel
+		seg.GetAWS()["deployment_id"] = metadata.BeanstalkMetadata.DeploymentID
+	}
+}
+
+// AddAnnotation allows adding an annotation to the segment.
+func (seg *Segment) AddAnnotation(key string, value interface{}) error {
+	switch value.(type) {
+	case bool, int, uint, float32, float64, string:
+	default:
+		return fmt.Errorf("failed to add annotation key: %q value: %q to subsegment %q. value must be of type string, number or boolean", key, value, seg.Name)
+	}
+
+	seg.Lock()
+	defer seg.Unlock()
+
+	if seg.Annotations == nil {
+		seg.Annotations = map[string]interface{}{}
+	}
+	seg.Annotations[key] = value
+	return nil
+}
+
+// AddMetadata allows adding metadata to the segment.
+func (seg *Segment) AddMetadata(key string, value interface{}) error {
+	seg.Lock()
+	defer seg.Unlock()
+
+	if seg.Metadata == nil {
+		seg.Metadata = map[string]map[string]interface{}{}
+	}
+	if seg.Metadata["default"] == nil {
+		seg.Metadata["default"] = map[string]interface{}{}
+	}
+	seg.Metadata["default"][key] = value
+	return nil
+}
+
+// AddMetadataToNamespace allows adding a namespace into metadata for the segment.
+func (seg *Segment) AddMetadataToNamespace(namespace string, key string, value interface{}) error {
+	seg.Lock()
+	defer seg.Unlock()
+
+	if seg.Metadata == nil {
+		seg.Metadata = map[string]map[string]interface{}{}
+	}
+	if seg.Metadata[namespace] == nil {
+		seg.Metadata[namespace] = map[string]interface{}{}
+	}
+	seg.Metadata[namespace][key] = value
+	return nil
+}
+
+// AddError allows adding an error to the segment.
+func (seg *Segment) AddError(err error) error {
+	seg.Lock()
+	defer seg.Unlock()
+
+	seg.Fault = true
+	seg.GetCause().WorkingDirectory, _ = os.Getwd()
+	seg.GetCause().Exceptions = append(seg.GetCause().Exceptions, privateCfg.ExceptionFormattingStrategy().ExceptionFromError(err))
+
+	return nil
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/segment_model.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/segment_model.go
new file mode 100644
index 00000000..80e85cb0
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/segment_model.go
@@ -0,0 +1,191 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+import (
+	"encoding/json"
+	"sync"
+
+	"github.com/aws/aws-xray-sdk-go/header"
+	"github.com/aws/aws-xray-sdk-go/strategy/exception"
+)
+
+// Segment provides the resource's name, details about the request, and details about the work done.
+type Segment struct {
+	sync.Mutex
+	parent           *Segment
+	openSegments     int
+	totalSubSegments int
+	Sampled          bool           `json:"-"`
+	RequestWasTraced bool           `json:"-"` // Used by xray.RequestWasTraced
+	ContextDone      bool           `json:"-"`
+	Emitted          bool           `json:"-"`
+	IncomingHeader   *header.Header `json:"-"`
+	ParentSegment    *Segment       `json:"-"` // The root of the Segment tree, the parent Segment (not Subsegment).
+
+	// Required
+	TraceID   string  `json:"trace_id,omitempty"`
+	ID        string  `json:"id"`
+	Name      string  `json:"name"`
+	StartTime float64 `json:"start_time"`
+	EndTime   float64 `json:"end_time,omitempty"`
+
+	// Optional
+	InProgress  bool       `json:"in_progress,omitempty"`
+	ParentID    string     `json:"parent_id,omitempty"`
+	Fault       bool       `json:"fault,omitempty"`
+	Error       bool       `json:"error,omitempty"`
+	Throttle    bool       `json:"throttle,omitempty"`
+	Cause       *CauseData `json:"cause,omitempty"`
+	ResourceARN string     `json:"resource_arn,omitempty"`
+	Origin      string     `json:"origin,omitempty"`
+
+	Type         string   `json:"type,omitempty"`
+	Namespace    string   `json:"namespace,omitempty"`
+	User         string   `json:"user,omitempty"`
+	PrecursorIDs []string `json:"precursor_ids,omitempty"`
+
+	HTTP *HTTPData              `json:"http,omitempty"`
+	AWS  map[string]interface{} `json:"aws,omitempty"`
+
+	Service *ServiceData `json:"service,omitempty"`
+
+	// SQL
+	SQL *SQLData `json:"sql,omitempty"`
+
+	// Metadata
+	Annotations map[string]interface{}            `json:"annotations,omitempty"`
+	Metadata    map[string]map[string]interface{} `json:"metadata,omitempty"`
+
+	// Children
+	Subsegments    []json.RawMessage `json:"subsegments,omitempty"`
+	rawSubsegments []*Segment
+}
+
+// CauseData provides the shape for unmarshaling data that records exception.
+type CauseData struct {
+	WorkingDirectory string                `json:"working_directory,omitempty"`
+	Paths            []string              `json:"paths,omitempty"`
+	Exceptions       []exception.Exception `json:"exceptions,omitempty"`
+}
+
+// HTTPData provides the shape for unmarshaling request and response data.
+type HTTPData struct {
+	Request  *RequestData  `json:"request,omitempty"`
+	Response *ResponseData `json:"response,omitempty"`
+}
+
+// RequestData provides the shape for unmarshaling request data.
+type RequestData struct {
+	Method        string `json:"method,omitempty"`
+	URL           string `json:"url,omitempty"` // http(s)://host/path
+	ClientIP      string `json:"client_ip,omitempty"`
+	UserAgent     string `json:"user_agent,omitempty"`
+	XForwardedFor bool   `json:"x_forwarded_for,omitempty"`
+	Traced        bool   `json:"traced,omitempty"`
+}
+
+// ResponseData provides the shape for unmarshaling response data.
+type ResponseData struct {
+	Status        int `json:"status,omitempty"`
+	ContentLength int `json:"content_length,omitempty"`
+}
+
+// ServiceData provides the shape for unmarshaling service version.
+type ServiceData struct {
+	Version string `json:"version,omitempty"`
+}
+
+// SQLData provides the shape for unmarshaling sql data.
+type SQLData struct {
+	ConnectionString string `json:"connection_string,omitempty"`
+	URL              string `json:"url,omitempty"` // host:port/database
+	DatabaseType     string `json:"database_type,omitempty"`
+	DatabaseVersion  string `json:"database_version,omitempty"`
+	DriverVersion    string `json:"driver_version,omitempty"`
+	User             string `json:"user,omitempty"`
+	Preparation      string `json:"preparation,omitempty"` // "statement" / "call"
+	SanitizedQuery   string `json:"sanitized_query,omitempty"`
+}
+
+// DownstreamHeader returns a header for passing to downstream calls.
+func (s *Segment) DownstreamHeader() *header.Header {
+	r := s.ParentSegment.IncomingHeader
+	if r == nil {
+		r = &header.Header{
+			TraceID: s.ParentSegment.TraceID,
+		}
+	}
+	if r.TraceID == "" {
+		r.TraceID = s.ParentSegment.TraceID
+	}
+	if s.ParentSegment.Sampled {
+		r.SamplingDecision = header.Sampled
+	} else {
+		r.SamplingDecision = header.NotSampled
+	}
+	r.ParentID = s.ID
+	return r
+}
+
+// GetCause returns value of Cause.
+func (s *Segment) GetCause() *CauseData {
+	if s.Cause == nil {
+		s.Cause = &CauseData{}
+	}
+	return s.Cause
+}
+
+// GetHTTP returns value of HTTP.
+func (s *Segment) GetHTTP() *HTTPData {
+	if s.HTTP == nil {
+		s.HTTP = &HTTPData{}
+	}
+	return s.HTTP
+}
+
+// GetAWS returns value of AWS.
+func (s *Segment) GetAWS() map[string]interface{} {
+	if s.AWS == nil {
+		s.AWS = make(map[string]interface{})
+	}
+	return s.AWS
+}
+
+// GetService returns value of Service.
+func (s *Segment) GetService() *ServiceData {
+	if s.Service == nil {
+		s.Service = &ServiceData{}
+	}
+	return s.Service
+}
+
+// GetSQL returns value of SQL.
+func (s *Segment) GetSQL() *SQLData {
+	if s.SQL == nil {
+		s.SQL = &SQLData{}
+	}
+	return s.SQL
+}
+
+// GetRequest returns value of RequestData.
+func (d *HTTPData) GetRequest() *RequestData {
+	if d.Request == nil {
+		d.Request = &RequestData{}
+	}
+	return d.Request
+}
+
+// GetResponse returns value of ResponseData.
+func (d *HTTPData) GetResponse() *ResponseData {
+	if d.Response == nil {
+		d.Response = &ResponseData{}
+	}
+	return d.Response
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/sql.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/sql.go
new file mode 100644
index 00000000..d463672f
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/sql.go
@@ -0,0 +1,274 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+import (
+	"bytes"
+	"context"
+	"database/sql"
+	"database/sql/driver"
+	"fmt"
+	"net/url"
+	"reflect"
+	"strings"
+	"time"
+)
+
+// SQL opens a normalized and traced wrapper around an *sql.DB connection.
+// It uses `sql.Open` internally and shares the same function signature.
+// To ensure passwords are filtered, it is HIGHLY RECOMMENDED that your DSN
+// follows the format: `<schema>://<user>:<password>@<host>:<port>/<database>`
+func SQL(driver, dsn string) (*DB, error) {
+	rawDB, err := sql.Open(driver, dsn)
+	if err != nil {
+		return nil, err
+	}
+
+	db := &DB{db: rawDB}
+
+	// Detect if DSN is a URL or not, set appropriate attribute
+	urlDsn := dsn
+	if !strings.Contains(dsn, "//") {
+		urlDsn = "//" + urlDsn
+	}
+	// Here we're trying to detect things like `host:port/database` as a URL, which is pretty hard
+	// So we just assume that if it's got a scheme, a user, or a query that it's probably a URL
+	if u, err := url.Parse(urlDsn); err == nil && (u.Scheme != "" || u.User != nil || u.RawQuery != "" || strings.Contains(u.Path, "@")) {
+		// Check that this isn't in the form of user/pass@host:port/db, as that will shove the host into the path
+		if strings.Contains(u.Path, "@") {
+			u, _ = url.Parse(fmt.Sprintf("%s//%s%%2F%s", u.Scheme, u.Host, u.Path[1:]))
+		}
+
+		// Strip password from user:password pair in address
+		if u.User != nil {
+			uname := u.User.Username()
+
+			// Some drivers use "user/pass@host:port" instead of "user:pass@host:port"
+			// So we must manually attempt to chop off a potential password.
+			// But we can skip this if we already found the password.
+			if _, ok := u.User.Password(); !ok {
+				uname = strings.Split(uname, "/")[0]
+			}
+
+			u.User = url.User(uname)
+		}
+
+		// Strip password from query parameters
+		q := u.Query()
+		q.Del("password")
+		u.RawQuery = q.Encode()
+
+		db.url = u.String()
+		if !strings.Contains(dsn, "//") {
+			db.url = db.url[2:]
+		}
+	} else {
+		// We don't *think* it's a URL, so now we have to try our best to strip passwords from
+		// some unknown DSL. We attempt to detect whether it's space-delimited or semicolon-delimited
+		// then remove any keys with the name "password" or "pwd". This won't catch everything, but
+		// from surveying the current (Jan 2017) landscape of drivers it should catch most.
+		db.connectionString = stripPasswords(dsn)
+	}
+
+	// Detect database type and use that to populate attributes
+	var detectors []func(*DB) error
+	switch driver {
+	case "postgres":
+		detectors = append(detectors, postgresDetector)
+	case "mysql":
+		detectors = append(detectors, mysqlDetector)
+	default:
+		detectors = append(detectors, postgresDetector, mysqlDetector, mssqlDetector, oracleDetector)
+	}
+	for _, detector := range detectors {
+		if detector(db) == nil {
+			break
+		}
+		db.databaseType = "Unknown"
+		db.databaseVersion = "Unknown"
+		db.user = "Unknown"
+		db.dbname = "Unknown"
+	}
+
+	// There's no standard to get SQL driver version information
+	// So we invent an interface by which drivers can provide us this data
+	type versionedDriver interface {
+		Version() string
+	}
+
+	d := db.db.Driver()
+	if vd, ok := d.(versionedDriver); ok {
+		db.driverVersion = vd.Version()
+	} else {
+		t := reflect.TypeOf(d)
+		for t.Kind() == reflect.Ptr {
+			t = t.Elem()
+		}
+		db.driverVersion = t.PkgPath()
+	}
+
+	return db, nil
+}
+
+// DB copies the interface of sql.DB but adds X-Ray tracing.
+// It must be created with xray.SQL.
+type DB struct {
+	db *sql.DB
+
+	connectionString string
+	url              string
+	databaseType     string
+	databaseVersion  string
+	driverVersion    string
+	user             string
+	dbname           string
+}
+
+// Close closes a database and returns error if any.
+func (db *DB) Close() error { return db.db.Close() }
+
+// Driver returns database's underlying driver.
+func (db *DB) Driver() driver.Driver { return db.db.Driver() }
+
+// Stats returns database statistics.
+func (db *DB) Stats() sql.DBStats { return db.db.Stats() }
+
+// SetConnMaxLifetime sets the maximum amount of time a connection may be reused.
+func (db *DB) SetConnMaxLifetime(d time.Duration) { db.db.SetConnMaxLifetime(d) }
+
+// SetMaxIdleConns sets the maximum number of connections in the idle connection pool.
+func (db *DB) SetMaxIdleConns(n int) { db.db.SetMaxIdleConns(n) }
+
+// SetMaxOpenConns sets the maximum number of open connections to the database.
+func (db *DB) SetMaxOpenConns(n int) { db.db.SetMaxOpenConns(n) }
+
+func (db *DB) populate(ctx context.Context, query string) {
+	seg := GetSegment(ctx)
+
+	seg.Lock()
+	seg.Namespace = "remote"
+	seg.GetSQL().ConnectionString = db.connectionString
+	seg.GetSQL().URL = db.url
+	seg.GetSQL().DatabaseType = db.databaseType
+	seg.GetSQL().DatabaseVersion = db.databaseVersion
+	seg.GetSQL().DriverVersion = db.driverVersion
+	seg.GetSQL().User = db.user
+	seg.GetSQL().SanitizedQuery = query
+	seg.Unlock()
+}
+
+// Tx copies the interface of sql.Tx but adds X-Ray tracing.
+// It must be created with xray.DB.Begin.
+type Tx struct {
+	db *DB
+	tx *sql.Tx
+}
+
+// Commit commits the transaction.
+func (tx *Tx) Commit() error { return tx.tx.Commit() }
+
+// Rollback aborts the transaction.
+func (tx *Tx) Rollback() error { return tx.tx.Rollback() }
+
+// Stmt copies the interface of sql.Stmt but adds X-Ray tracing.
+// It must be created with xray.DB.Prepare or xray.Tx.Stmt.
+type Stmt struct {
+	db    *DB
+	stmt  *sql.Stmt
+	query string
+}
+
+// Close closes the statement.
+func (stmt *Stmt) Close() error { return stmt.stmt.Close() }
+
+func (stmt *Stmt) populate(ctx context.Context, query string) {
+	stmt.db.populate(ctx, query)
+
+	seg := GetSegment(ctx)
+	seg.Lock()
+	seg.GetSQL().Preparation = "statement"
+	seg.Unlock()
+}
+
+func postgresDetector(db *DB) error {
+	db.databaseType = "Postgres"
+	row := db.db.QueryRow("SELECT version(), current_user, current_database()")
+	return row.Scan(&db.databaseVersion, &db.user, &db.dbname)
+}
+
+func mysqlDetector(db *DB) error {
+	db.databaseType = "MySQL"
+	row := db.db.QueryRow("SELECT version(), current_user(), database()")
+	return row.Scan(&db.databaseVersion, &db.user, &db.dbname)
+}
+
+func mssqlDetector(db *DB) error {
+	db.databaseType = "MS SQL"
+	row := db.db.QueryRow("SELECT @@version, current_user, db_name()")
+	return row.Scan(&db.databaseVersion, &db.user, &db.dbname)
+}
+
+func oracleDetector(db *DB) error {
+	db.databaseType = "Oracle"
+	row := db.db.QueryRow("SELECT version FROM v$instance UNION SELECT user, ora_database_name FROM dual")
+	return row.Scan(&db.databaseVersion, &db.user, &db.dbname)
+}
+
+func stripPasswords(dsn string) string {
+	var (
+		tok        bytes.Buffer
+		res        bytes.Buffer
+		isPassword bool
+		inBraces   bool
+		delimiter  byte = ' '
+	)
+	flush := func() {
+		if inBraces {
+			return
+		}
+		if !isPassword {
+			res.Write(tok.Bytes())
+		}
+		tok.Reset()
+		isPassword = false
+	}
+	if strings.Count(dsn, ";") > strings.Count(dsn, " ") {
+		delimiter = ';'
+	}
+
+	buf := strings.NewReader(dsn)
+	for c, err := buf.ReadByte(); err == nil; c, err = buf.ReadByte() {
+		tok.WriteByte(c)
+		switch c {
+		case ':', delimiter:
+			flush()
+		case '=':
+			tokStr := strings.ToLower(tok.String())
+			isPassword = `password=` == tokStr || `pwd=` == tokStr
+			if b, err := buf.ReadByte(); err == nil && b == '{' {
+				inBraces = true
+			}
+			buf.UnreadByte()
+		case '}':
+			b, err := buf.ReadByte()
+			if err != nil {
+				break
+			}
+			if b == '}' {
+				tok.WriteByte(b)
+			} else {
+				inBraces = false
+				buf.UnreadByte()
+			}
+		}
+	}
+	inBraces = false
+	flush()
+	return res.String()
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/sql_go17.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/sql_go17.go
new file mode 100644
index 00000000..2690e001
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/sql_go17.go
@@ -0,0 +1,183 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+// +build !go1.8
+
+package xray
+
+import (
+	"context"
+	"database/sql"
+)
+
+// Begin starts a transaction.
+func (db *DB) Begin(ctx context.Context, opts interface{}) (*Tx, error) {
+	tx, err := db.db.Begin()
+	return &Tx{db, tx}, err
+}
+
+// Prepare creates a prepared statement for later queries or executions.
+func (db *DB) Prepare(ctx context.Context, query string) (*Stmt, error) {
+	stmt, err := db.db.Prepare(query)
+	return &Stmt{db, stmt, query}, err
+}
+
+// Ping traces verifying a connection to the database is still alive,
+// establishing a connection if necessary and adds corresponding information into subsegment.
+func (db *DB) Ping(ctx context.Context) error {
+	return Capture(ctx, db.dbname, func(ctx context.Context) error {
+		db.populate(ctx, "PING")
+		return db.db.Ping()
+	})
+}
+
+// Exec captures executing a query without returning any rows and
+// adds corresponding information into subsegment.
+func (db *DB) Exec(ctx context.Context, query string, args ...interface{}) (sql.Result, error) {
+	var res sql.Result
+
+	err := Capture(ctx, db.dbname, func(ctx context.Context) error {
+		db.populate(ctx, query)
+
+		var err error
+		res, err = db.db.Exec(query, args...)
+		return err
+	})
+
+	return res, err
+}
+
+// Query captures executing a query that returns rows and adds corresponding information into subsegment.
+func (db *DB) Query(ctx context.Context, query string, args ...interface{}) (*sql.Rows, error) {
+	var res *sql.Rows
+
+	err := Capture(ctx, db.dbname, func(ctx context.Context) error {
+		db.populate(ctx, query)
+
+		var err error
+		res, err = db.db.Query(query, args...)
+		return err
+	})
+
+	return res, err
+}
+
+// QueryRow captures executing a query that is expected to return at most one row
+// and adds corresponding information into subsegment.
+func (db *DB) QueryRow(ctx context.Context, query string, args ...interface{}) *sql.Row {
+	var res *sql.Row
+
+	Capture(ctx, db.dbname, func(ctx context.Context) error {
+		db.populate(ctx, query)
+
+		res = db.db.QueryRow(query, args...)
+		return nil
+	})
+
+	return res
+}
+
+// Exec captures executing a query that doesn't return rows and adds
+// corresponding information into subsegment.
+func (tx *Tx) Exec(ctx context.Context, query string, args ...interface{}) (sql.Result, error) {
+	var res sql.Result
+
+	err := Capture(ctx, tx.db.dbname, func(ctx context.Context) error {
+		tx.db.populate(ctx, query)
+
+		var err error
+		res, err = tx.tx.Exec(query, args...)
+		return err
+	})
+
+	return res, err
+}
+
+// Query captures executing a query that returns rows and adds corresponding information into subsegment.
+func (tx *Tx) Query(ctx context.Context, query string, args ...interface{}) (*sql.Rows, error) {
+	var res *sql.Rows
+
+	err := Capture(ctx, tx.db.dbname, func(ctx context.Context) error {
+		tx.db.populate(ctx, query)
+
+		var err error
+		res, err = tx.tx.Query(query, args...)
+		return err
+	})
+
+	return res, err
+}
+
+// QueryRow captures executing a query that is expected to return at most one row and adds
+// corresponding information into subsegment.
+func (tx *Tx) QueryRow(ctx context.Context, query string, args ...interface{}) *sql.Row {
+	var res *sql.Row
+
+	Capture(ctx, tx.db.dbname, func(ctx context.Context) error {
+		tx.db.populate(ctx, query)
+
+		res = tx.tx.QueryRow(query, args...)
+		return nil
+	})
+
+	return res
+}
+
+// Stmt returns a transaction-specific prepared statement from an existing statement.
+func (tx *Tx) Stmt(ctx context.Context, stmt *Stmt) *Stmt {
+	return &Stmt{stmt.db, tx.tx.Stmt(stmt.stmt), stmt.query}
+}
+
+// Exec captures executing a prepared statement with the given arguments and
+// returning a Result summarizing the effect of the statement and adds corresponding
+// information into subsegment.
+func (stmt *Stmt) Exec(ctx context.Context, args ...interface{}) (sql.Result, error) {
+	var res sql.Result
+
+	err := Capture(ctx, stmt.db.dbname, func(ctx context.Context) error {
+		stmt.populate(ctx, stmt.query)
+
+		var err error
+		res, err = stmt.stmt.Exec(args...)
+		return err
+	})
+
+	return res, err
+}
+
+// Query captures executing a prepared query statement with the given arguments
+// and returning the query results as a *Rows and adds corresponding information
+// into subsegment.
+func (stmt *Stmt) Query(ctx context.Context, args ...interface{}) (*sql.Rows, error) {
+	var res *sql.Rows
+
+	err := Capture(ctx, stmt.db.dbname, func(ctx context.Context) error {
+		stmt.populate(ctx, stmt.query)
+
+		var err error
+		res, err = stmt.stmt.Query(args...)
+		return err
+	})
+
+	return res, err
+}
+
+// QueryRow captures executing a prepared query statement with the given arguments and
+// adds corresponding information into subsegment.
+func (stmt *Stmt) QueryRow(ctx context.Context, args ...interface{}) *sql.Row {
+	var res *sql.Row
+
+	Capture(ctx, stmt.db.dbname, func(ctx context.Context) error {
+		stmt.populate(ctx, stmt.query)
+
+		res = stmt.stmt.QueryRow(args...)
+		return nil
+	})
+
+	return res
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/sql_go18.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/sql_go18.go
new file mode 100644
index 00000000..2ee0e30c
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/sql_go18.go
@@ -0,0 +1,183 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+// +build go1.8
+
+package xray
+
+import (
+	"context"
+	"database/sql"
+)
+
+// Begin starts a transaction.
+func (db *DB) Begin(ctx context.Context, opts *sql.TxOptions) (*Tx, error) {
+	tx, err := db.db.BeginTx(ctx, opts)
+	return &Tx{db, tx}, err
+}
+
+// Prepare creates a prepared statement for later queries or executions.
+func (db *DB) Prepare(ctx context.Context, query string) (*Stmt, error) {
+	stmt, err := db.db.PrepareContext(ctx, query)
+	return &Stmt{db, stmt, query}, err
+}
+
+// Ping traces verifying a connection to the database is still alive,
+// establishing a connection if necessary and adds corresponding information into subsegment.
+func (db *DB) Ping(ctx context.Context) error {
+	return Capture(ctx, db.dbname, func(ctx context.Context) error {
+		db.populate(ctx, "PING")
+		return db.db.PingContext(ctx)
+	})
+}
+
+// Exec captures executing a query without returning any rows and
+// adds corresponding information into subsegment.
+func (db *DB) Exec(ctx context.Context, query string, args ...interface{}) (sql.Result, error) {
+	var res sql.Result
+
+	err := Capture(ctx, db.dbname, func(ctx context.Context) error {
+		db.populate(ctx, query)
+
+		var err error
+		res, err = db.db.ExecContext(ctx, query, args...)
+		return err
+	})
+
+	return res, err
+}
+
+// Query captures executing a query that returns rows and adds corresponding information into subsegment.
+func (db *DB) Query(ctx context.Context, query string, args ...interface{}) (*sql.Rows, error) {
+	var res *sql.Rows
+
+	err := Capture(ctx, db.dbname, func(ctx context.Context) error {
+		db.populate(ctx, query)
+
+		var err error
+		res, err = db.db.QueryContext(ctx, query, args...)
+		return err
+	})
+
+	return res, err
+}
+
+// QueryRow captures executing a query that is expected to return at most one row
+// and adds corresponding information into subsegment.
+func (db *DB) QueryRow(ctx context.Context, query string, args ...interface{}) *sql.Row {
+	var res *sql.Row
+
+	Capture(ctx, db.dbname, func(ctx context.Context) error {
+		db.populate(ctx, query)
+
+		res = db.db.QueryRowContext(ctx, query, args...)
+		return nil
+	})
+
+	return res
+}
+
+// Exec captures executing a query that doesn't return rows and adds
+// corresponding information into subsegment.
+func (tx *Tx) Exec(ctx context.Context, query string, args ...interface{}) (sql.Result, error) {
+	var res sql.Result
+
+	err := Capture(ctx, tx.db.dbname, func(ctx context.Context) error {
+		tx.db.populate(ctx, query)
+
+		var err error
+		res, err = tx.tx.ExecContext(ctx, query, args...)
+		return err
+	})
+
+	return res, err
+}
+
+// Query captures executing a query that returns rows and adds corresponding information into subsegment.
+func (tx *Tx) Query(ctx context.Context, query string, args ...interface{}) (*sql.Rows, error) {
+	var res *sql.Rows
+
+	err := Capture(ctx, tx.db.dbname, func(ctx context.Context) error {
+		tx.db.populate(ctx, query)
+
+		var err error
+		res, err = tx.tx.QueryContext(ctx, query, args...)
+		return err
+	})
+
+	return res, err
+}
+
+// QueryRow captures executing a query that is expected to return at most one row and adds
+// corresponding information into subsegment.
+func (tx *Tx) QueryRow(ctx context.Context, query string, args ...interface{}) *sql.Row {
+	var res *sql.Row
+
+	Capture(ctx, tx.db.dbname, func(ctx context.Context) error {
+		tx.db.populate(ctx, query)
+
+		res = tx.tx.QueryRowContext(ctx, query, args...)
+		return nil
+	})
+
+	return res
+}
+
+// Stmt returns a transaction-specific prepared statement from an existing statement.
+func (tx *Tx) Stmt(ctx context.Context, stmt *Stmt) *Stmt {
+	return &Stmt{stmt.db, tx.tx.StmtContext(ctx, stmt.stmt), stmt.query}
+}
+
+// Exec captures executing a prepared statement with the given arguments and
+// returning a Result summarizing the effect of the statement and adds corresponding
+// information into subsegment.
+func (stmt *Stmt) Exec(ctx context.Context, args ...interface{}) (sql.Result, error) {
+	var res sql.Result
+
+	err := Capture(ctx, stmt.db.dbname, func(ctx context.Context) error {
+		stmt.populate(ctx, stmt.query)
+
+		var err error
+		res, err = stmt.stmt.ExecContext(ctx, args...)
+		return err
+	})
+
+	return res, err
+}
+
+// Query captures executing a prepared query statement with the given arguments
+// and returning the query results as a *Rows and adds corresponding information
+// into subsegment.
+func (stmt *Stmt) Query(ctx context.Context, args ...interface{}) (*sql.Rows, error) {
+	var res *sql.Rows
+
+	err := Capture(ctx, stmt.db.dbname, func(ctx context.Context) error {
+		stmt.populate(ctx, stmt.query)
+
+		var err error
+		res, err = stmt.stmt.QueryContext(ctx, args...)
+		return err
+	})
+
+	return res, err
+}
+
+// QueryRow captures executing a prepared query statement with the given arguments and
+// adds corresponding information into subsegment.
+func (stmt *Stmt) QueryRow(ctx context.Context, args ...interface{}) *sql.Row {
+	var res *sql.Row
+
+	Capture(ctx, stmt.db.dbname, func(ctx context.Context) error {
+		stmt.populate(ctx, stmt.query)
+
+		res = stmt.stmt.QueryRowContext(ctx, args...)
+		return nil
+	})
+
+	return res
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/streaming_strategy.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/streaming_strategy.go
new file mode 100644
index 00000000..9f88174a
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/aws/aws-xray-sdk-go/xray/streaming_strategy.go
@@ -0,0 +1,15 @@
+// Copyright 2017-2017 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+//
+//     http://aws.amazon.com/apache2.0/
+//
+// or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+
+package xray
+
+// StreamingStrategy provides an interface for implementing streaming strategies.
+type StreamingStrategy interface {
+	RequiresStreaming(seg *Segment) bool
+	StreamCompletedSubsegments(seg *Segment) [][]byte
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/LICENSE.txt b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/LICENSE.txt
new file mode 100644
index 00000000..8c706814
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/LICENSE.txt
@@ -0,0 +1,24 @@
+Copyright (c) 2012, Cloud Instruments Co., Ltd. <info@cin.io>
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+    * Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    * Neither the name of the Cloud Instruments Co., Ltd. nor the
+      names of its contributors may be used to endorse or promote products
+      derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/README.markdown b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/README.markdown
new file mode 100644
index 00000000..b9acd2d1
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/README.markdown
@@ -0,0 +1,113 @@
+Seelog
+=======
+
+Seelog is a powerful and easy-to-learn logging framework that provides functionality for flexible dispatching, filtering, and formatting log messages.
+It is natively written in the [Go](http://golang.org/) programming language. 
+
+[![Build Status](https://drone.io/github.com/cihub/seelog/status.png)](https://drone.io/github.com/cihub/seelog/latest)
+
+Features
+------------------
+
+* Xml configuring to be able to change logger parameters without recompilation
+* Changing configurations on the fly without app restart
+* Possibility to set different log configurations for different project files and functions
+* Adjustable message formatting
+* Simultaneous log output to multiple streams
+* Choosing logger priority strategy to minimize performance hit
+* Different output writers
+  * Console writer
+  * File writer 
+  * Buffered writer (Chunk writer)
+  * Rolling log writer (Logging with rotation)
+  * SMTP writer
+  * Others... (See [Wiki](https://github.com/cihub/seelog/wiki))
+* Log message wrappers (JSON, XML, etc.)
+* Global variables and functions for easy usage in standalone apps
+* Functions for flexible usage in libraries
+
+Quick-start
+-----------
+
+```go
+package main
+
+import log "github.com/cihub/seelog"
+
+func main() {
+    defer log.Flush()
+    log.Info("Hello from Seelog!")
+}
+```
+
+Installation
+------------
+
+If you don't have the Go development environment installed, visit the 
+[Getting Started](http://golang.org/doc/install.html) document and follow the instructions. Once you're ready, execute the following command:
+
+```
+go get -u github.com/cihub/seelog
+```
+
+*IMPORTANT*: If you are not using the latest release version of Go, check out this [wiki page](https://github.com/cihub/seelog/wiki/Notes-on-'go-get')
+
+Documentation
+---------------
+
+Seelog has github wiki pages, which contain detailed how-tos references: https://github.com/cihub/seelog/wiki
+
+Examples
+---------------
+
+Seelog examples can be found here: [seelog-examples](https://github.com/cihub/seelog-examples)
+
+Issues
+---------------
+
+Feel free to push issues that could make Seelog better: https://github.com/cihub/seelog/issues
+
+Changelog
+---------------
+
+* **v2.5** : Interaction with other systems. Part 2: custom receivers
+    * Finished custom receivers feature. Check [wiki](https://github.com/cihub/seelog/wiki/custom-receivers)
+    * Added 'LoggerFromCustomReceiver'
+    * Added 'LoggerFromWriterWithMinLevelAndFormat'
+    * Added 'LoggerFromCustomReceiver'
+    * Added 'LoggerFromParamConfigAs...' 
+* **v2.4** : Interaction with other systems. Part 1: wrapping seelog
+    * Added configurable caller stack skip logic
+    * Added 'SetAdditionalStackDepth' to 'LoggerInterface'
+* **v2.3** : Rethinking 'rolling' receiver
+    * Reimplemented 'rolling' receiver
+    * Added 'Max rolls' feature for 'rolling' receiver with type='date'
+    * Fixed 'rolling' receiver issue: renaming on Windows
+* **v2.2** : go1.0 compatibility point [go1.0 tag]
+    * Fixed internal bugs
+    * Added 'ANSI n [;k]' format identifier:  %EscN
+    * Made current release go1 compatible 
+* **v2.1** : Some new features
+    * Rolling receiver archiving option.
+    * Added format identifier: %Line
+    * Smtp: added paths to PEM files directories
+    * Added format identifier: %FuncShort
+    * Warn, Error and Critical methods now return an error
+* **v2.0** : Second major release. BREAKING CHANGES.
+    * Support of binaries with stripped symbols
+    * Added log strategy: adaptive
+    * Critical message now forces Flush()
+    * Added predefined formats: xml-debug, xml-debug-short, xml, xml-short, json-debug, json-debug-short, json, json-short, debug, debug-short, fast
+    * Added receiver: conn (network connection writer)
+    * BREAKING CHANGE: added Tracef, Debugf, Infof, etc. to satisfy the print/printf principle
+    * Bug fixes
+* **v1.0** : Initial release. Features:
+    * Xml config
+    * Changing configurations on the fly without app restart
+    * Contraints and exceptions
+    * Formatting
+    * Log strategies: sync, async loop, async timer
+    * Receivers: buffered, console, file, rolling, smtp
+
+
+
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/behavior_adaptivelogger.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/behavior_adaptivelogger.go
new file mode 100644
index 00000000..0c640cae
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/behavior_adaptivelogger.go
@@ -0,0 +1,129 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"errors"
+	"fmt"
+	"math"
+	"time"
+)
+
+var (
+	adaptiveLoggerMaxInterval         = time.Minute
+	adaptiveLoggerMaxCriticalMsgCount = uint32(1000)
+)
+
+// asyncAdaptiveLogger represents asynchronous adaptive logger which acts like
+// an async timer logger, but its interval depends on the current message count
+// in the queue.
+//
+// Interval = I, minInterval = m, maxInterval = M, criticalMsgCount = C, msgCount = c:
+// I = m + (C - Min(c, C)) / C * (M - m)
+type asyncAdaptiveLogger struct {
+	asyncLogger
+	minInterval      time.Duration
+	criticalMsgCount uint32
+	maxInterval      time.Duration
+}
+
+// NewAsyncLoopLogger creates a new asynchronous adaptive logger
+func NewAsyncAdaptiveLogger(
+	config *logConfig,
+	minInterval time.Duration,
+	maxInterval time.Duration,
+	criticalMsgCount uint32) (*asyncAdaptiveLogger, error) {
+
+	if minInterval <= 0 {
+		return nil, errors.New("async adaptive logger min interval should be > 0")
+	}
+
+	if maxInterval > adaptiveLoggerMaxInterval {
+		return nil, fmt.Errorf("async adaptive logger max interval should be <= %s",
+			adaptiveLoggerMaxInterval)
+	}
+
+	if criticalMsgCount <= 0 {
+		return nil, errors.New("async adaptive logger critical msg count should be > 0")
+	}
+
+	if criticalMsgCount > adaptiveLoggerMaxCriticalMsgCount {
+		return nil, fmt.Errorf("async adaptive logger critical msg count should be <= %s",
+			adaptiveLoggerMaxInterval)
+	}
+
+	asnAdaptiveLogger := new(asyncAdaptiveLogger)
+
+	asnAdaptiveLogger.asyncLogger = *newAsyncLogger(config)
+	asnAdaptiveLogger.minInterval = minInterval
+	asnAdaptiveLogger.maxInterval = maxInterval
+	asnAdaptiveLogger.criticalMsgCount = criticalMsgCount
+
+	go asnAdaptiveLogger.processQueue()
+
+	return asnAdaptiveLogger, nil
+}
+
+func (asnAdaptiveLogger *asyncAdaptiveLogger) processItem() (closed bool, itemCount int) {
+	asnAdaptiveLogger.queueHasElements.L.Lock()
+	defer asnAdaptiveLogger.queueHasElements.L.Unlock()
+
+	for asnAdaptiveLogger.msgQueue.Len() == 0 && !asnAdaptiveLogger.Closed() {
+		asnAdaptiveLogger.queueHasElements.Wait()
+	}
+
+	if asnAdaptiveLogger.Closed() {
+		return true, asnAdaptiveLogger.msgQueue.Len()
+	}
+
+	asnAdaptiveLogger.processQueueElement()
+	return false, asnAdaptiveLogger.msgQueue.Len() - 1
+}
+
+// I = m + (C - Min(c, C)) / C * (M - m) =>
+// I = m + cDiff * mDiff,
+// 		cDiff = (C - Min(c, C)) / C)
+//		mDiff = (M - m)
+func (asnAdaptiveLogger *asyncAdaptiveLogger) calcAdaptiveInterval(msgCount int) time.Duration {
+	critCountF := float64(asnAdaptiveLogger.criticalMsgCount)
+	cDiff := (critCountF - math.Min(float64(msgCount), critCountF)) / critCountF
+	mDiff := float64(asnAdaptiveLogger.maxInterval - asnAdaptiveLogger.minInterval)
+
+	return asnAdaptiveLogger.minInterval + time.Duration(cDiff*mDiff)
+}
+
+func (asnAdaptiveLogger *asyncAdaptiveLogger) processQueue() {
+	for !asnAdaptiveLogger.Closed() {
+		closed, itemCount := asnAdaptiveLogger.processItem()
+
+		if closed {
+			break
+		}
+
+		interval := asnAdaptiveLogger.calcAdaptiveInterval(itemCount)
+
+		<-time.After(interval)
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/behavior_asynclogger.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/behavior_asynclogger.go
new file mode 100644
index 00000000..75231067
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/behavior_asynclogger.go
@@ -0,0 +1,142 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"container/list"
+	"fmt"
+	"sync"
+)
+
+// MaxQueueSize is the critical number of messages in the queue that result in an immediate flush.
+const (
+	MaxQueueSize = 10000
+)
+
+type msgQueueItem struct {
+	level   LogLevel
+	context LogContextInterface
+	message fmt.Stringer
+}
+
+// asyncLogger represents common data for all asynchronous loggers
+type asyncLogger struct {
+	commonLogger
+	msgQueue         *list.List
+	queueHasElements *sync.Cond
+}
+
+// newAsyncLogger creates a new asynchronous logger
+func newAsyncLogger(config *logConfig) *asyncLogger {
+	asnLogger := new(asyncLogger)
+
+	asnLogger.msgQueue = list.New()
+	asnLogger.queueHasElements = sync.NewCond(new(sync.Mutex))
+
+	asnLogger.commonLogger = *newCommonLogger(config, asnLogger)
+
+	return asnLogger
+}
+
+func (asnLogger *asyncLogger) innerLog(
+	level LogLevel,
+	context LogContextInterface,
+	message fmt.Stringer) {
+
+	asnLogger.addMsgToQueue(level, context, message)
+}
+
+func (asnLogger *asyncLogger) Close() {
+	asnLogger.m.Lock()
+	defer asnLogger.m.Unlock()
+
+	if !asnLogger.Closed() {
+		asnLogger.flushQueue(true)
+		asnLogger.config.RootDispatcher.Flush()
+
+		if err := asnLogger.config.RootDispatcher.Close(); err != nil {
+			reportInternalError(err)
+		}
+
+		asnLogger.closedM.Lock()
+		asnLogger.closed = true
+		asnLogger.closedM.Unlock()
+		asnLogger.queueHasElements.Broadcast()
+	}
+}
+
+func (asnLogger *asyncLogger) Flush() {
+	asnLogger.m.Lock()
+	defer asnLogger.m.Unlock()
+
+	if !asnLogger.Closed() {
+		asnLogger.flushQueue(true)
+		asnLogger.config.RootDispatcher.Flush()
+	}
+}
+
+func (asnLogger *asyncLogger) flushQueue(lockNeeded bool) {
+	if lockNeeded {
+		asnLogger.queueHasElements.L.Lock()
+		defer asnLogger.queueHasElements.L.Unlock()
+	}
+
+	for asnLogger.msgQueue.Len() > 0 {
+		asnLogger.processQueueElement()
+	}
+}
+
+func (asnLogger *asyncLogger) processQueueElement() {
+	if asnLogger.msgQueue.Len() > 0 {
+		backElement := asnLogger.msgQueue.Front()
+		msg, _ := backElement.Value.(msgQueueItem)
+		asnLogger.processLogMsg(msg.level, msg.message, msg.context)
+		asnLogger.msgQueue.Remove(backElement)
+	}
+}
+
+func (asnLogger *asyncLogger) addMsgToQueue(
+	level LogLevel,
+	context LogContextInterface,
+	message fmt.Stringer) {
+
+	if !asnLogger.Closed() {
+		asnLogger.queueHasElements.L.Lock()
+		defer asnLogger.queueHasElements.L.Unlock()
+
+		if asnLogger.msgQueue.Len() >= MaxQueueSize {
+			fmt.Printf("Seelog queue overflow: more than %v messages in the queue. Flushing.\n", MaxQueueSize)
+			asnLogger.flushQueue(false)
+		}
+
+		queueItem := msgQueueItem{level, context, message}
+
+		asnLogger.msgQueue.PushBack(queueItem)
+		asnLogger.queueHasElements.Broadcast()
+	} else {
+		err := fmt.Errorf("queue closed! Cannot process element: %d %#v", level, message)
+		reportInternalError(err)
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/behavior_asynclooplogger.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/behavior_asynclooplogger.go
new file mode 100644
index 00000000..972467b3
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/behavior_asynclooplogger.go
@@ -0,0 +1,69 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+// asyncLoopLogger represents asynchronous logger which processes the log queue in
+// a 'for' loop
+type asyncLoopLogger struct {
+	asyncLogger
+}
+
+// NewAsyncLoopLogger creates a new asynchronous loop logger
+func NewAsyncLoopLogger(config *logConfig) *asyncLoopLogger {
+
+	asnLoopLogger := new(asyncLoopLogger)
+
+	asnLoopLogger.asyncLogger = *newAsyncLogger(config)
+
+	go asnLoopLogger.processQueue()
+
+	return asnLoopLogger
+}
+
+func (asnLoopLogger *asyncLoopLogger) processItem() (closed bool) {
+	asnLoopLogger.queueHasElements.L.Lock()
+	defer asnLoopLogger.queueHasElements.L.Unlock()
+
+	for asnLoopLogger.msgQueue.Len() == 0 && !asnLoopLogger.Closed() {
+		asnLoopLogger.queueHasElements.Wait()
+	}
+
+	if asnLoopLogger.Closed() {
+		return true
+	}
+
+	asnLoopLogger.processQueueElement()
+	return false
+}
+
+func (asnLoopLogger *asyncLoopLogger) processQueue() {
+	for !asnLoopLogger.Closed() {
+		closed := asnLoopLogger.processItem()
+
+		if closed {
+			break
+		}
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/behavior_asynctimerlogger.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/behavior_asynctimerlogger.go
new file mode 100644
index 00000000..8118f205
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/behavior_asynctimerlogger.go
@@ -0,0 +1,82 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"errors"
+	"time"
+)
+
+// asyncTimerLogger represents asynchronous logger which processes the log queue each
+// 'duration' nanoseconds
+type asyncTimerLogger struct {
+	asyncLogger
+	interval time.Duration
+}
+
+// NewAsyncLoopLogger creates a new asynchronous loop logger
+func NewAsyncTimerLogger(config *logConfig, interval time.Duration) (*asyncTimerLogger, error) {
+
+	if interval <= 0 {
+		return nil, errors.New("async logger interval should be > 0")
+	}
+
+	asnTimerLogger := new(asyncTimerLogger)
+
+	asnTimerLogger.asyncLogger = *newAsyncLogger(config)
+	asnTimerLogger.interval = interval
+
+	go asnTimerLogger.processQueue()
+
+	return asnTimerLogger, nil
+}
+
+func (asnTimerLogger *asyncTimerLogger) processItem() (closed bool) {
+	asnTimerLogger.queueHasElements.L.Lock()
+	defer asnTimerLogger.queueHasElements.L.Unlock()
+
+	for asnTimerLogger.msgQueue.Len() == 0 && !asnTimerLogger.Closed() {
+		asnTimerLogger.queueHasElements.Wait()
+	}
+
+	if asnTimerLogger.Closed() {
+		return true
+	}
+
+	asnTimerLogger.processQueueElement()
+	return false
+}
+
+func (asnTimerLogger *asyncTimerLogger) processQueue() {
+	for !asnTimerLogger.Closed() {
+		closed := asnTimerLogger.processItem()
+
+		if closed {
+			break
+		}
+
+		<-time.After(asnTimerLogger.interval)
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/behavior_synclogger.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/behavior_synclogger.go
new file mode 100644
index 00000000..5a022ebc
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/behavior_synclogger.go
@@ -0,0 +1,75 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"fmt"
+)
+
+// syncLogger performs logging in the same goroutine where 'Trace/Debug/...'
+// func was called
+type syncLogger struct {
+	commonLogger
+}
+
+// NewSyncLogger creates a new synchronous logger
+func NewSyncLogger(config *logConfig) *syncLogger {
+	syncLogger := new(syncLogger)
+
+	syncLogger.commonLogger = *newCommonLogger(config, syncLogger)
+
+	return syncLogger
+}
+
+func (syncLogger *syncLogger) innerLog(
+	level LogLevel,
+	context LogContextInterface,
+	message fmt.Stringer) {
+
+	syncLogger.processLogMsg(level, message, context)
+}
+
+func (syncLogger *syncLogger) Close() {
+	syncLogger.m.Lock()
+	defer syncLogger.m.Unlock()
+
+	if !syncLogger.Closed() {
+		if err := syncLogger.config.RootDispatcher.Close(); err != nil {
+			reportInternalError(err)
+		}
+		syncLogger.closedM.Lock()
+		syncLogger.closed = true
+		syncLogger.closedM.Unlock()
+	}
+}
+
+func (syncLogger *syncLogger) Flush() {
+	syncLogger.m.Lock()
+	defer syncLogger.m.Unlock()
+
+	if !syncLogger.Closed() {
+		syncLogger.config.RootDispatcher.Flush()
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/cfg_config.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/cfg_config.go
new file mode 100644
index 00000000..c7d84812
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/cfg_config.go
@@ -0,0 +1,188 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"bytes"
+	"encoding/xml"
+	"io"
+	"os"
+)
+
+// LoggerFromConfigAsFile creates logger with config from file. File should contain valid seelog xml.
+func LoggerFromConfigAsFile(fileName string) (LoggerInterface, error) {
+	file, err := os.Open(fileName)
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close()
+
+	conf, err := configFromReader(file)
+	if err != nil {
+		return nil, err
+	}
+
+	return createLoggerFromFullConfig(conf)
+}
+
+// LoggerFromConfigAsBytes creates a logger with config from bytes stream. Bytes should contain valid seelog xml.
+func LoggerFromConfigAsBytes(data []byte) (LoggerInterface, error) {
+	conf, err := configFromReader(bytes.NewBuffer(data))
+	if err != nil {
+		return nil, err
+	}
+
+	return createLoggerFromFullConfig(conf)
+}
+
+// LoggerFromConfigAsString creates a logger with config from a string. String should contain valid seelog xml.
+func LoggerFromConfigAsString(data string) (LoggerInterface, error) {
+	return LoggerFromConfigAsBytes([]byte(data))
+}
+
+// LoggerFromParamConfigAsFile does the same as LoggerFromConfigAsFile, but includes special parser options.
+// See 'CfgParseParams' comments.
+func LoggerFromParamConfigAsFile(fileName string, parserParams *CfgParseParams) (LoggerInterface, error) {
+	file, err := os.Open(fileName)
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close()
+
+	conf, err := configFromReaderWithConfig(file, parserParams)
+	if err != nil {
+		return nil, err
+	}
+
+	return createLoggerFromFullConfig(conf)
+}
+
+// LoggerFromParamConfigAsBytes does the same as LoggerFromConfigAsBytes, but includes special parser options.
+// See 'CfgParseParams' comments.
+func LoggerFromParamConfigAsBytes(data []byte, parserParams *CfgParseParams) (LoggerInterface, error) {
+	conf, err := configFromReaderWithConfig(bytes.NewBuffer(data), parserParams)
+	if err != nil {
+		return nil, err
+	}
+
+	return createLoggerFromFullConfig(conf)
+}
+
+// LoggerFromParamConfigAsString does the same as LoggerFromConfigAsString, but includes special parser options.
+// See 'CfgParseParams' comments.
+func LoggerFromParamConfigAsString(data string, parserParams *CfgParseParams) (LoggerInterface, error) {
+	return LoggerFromParamConfigAsBytes([]byte(data), parserParams)
+}
+
+// LoggerFromWriterWithMinLevel is shortcut for LoggerFromWriterWithMinLevelAndFormat(output, minLevel, DefaultMsgFormat)
+func LoggerFromWriterWithMinLevel(output io.Writer, minLevel LogLevel) (LoggerInterface, error) {
+	return LoggerFromWriterWithMinLevelAndFormat(output, minLevel, DefaultMsgFormat)
+}
+
+// LoggerFromWriterWithMinLevelAndFormat creates a proxy logger that uses io.Writer as the
+// receiver with minimal level = minLevel and with specified format.
+//
+// All messages with level more or equal to minLevel will be written to output and
+// formatted using the default seelog format.
+//
+// Can be called for usage with non-Seelog systems
+func LoggerFromWriterWithMinLevelAndFormat(output io.Writer, minLevel LogLevel, format string) (LoggerInterface, error) {
+	constraints, err := NewMinMaxConstraints(minLevel, CriticalLvl)
+	if err != nil {
+		return nil, err
+	}
+	formatter, err := NewFormatter(format)
+	if err != nil {
+		return nil, err
+	}
+	dispatcher, err := NewSplitDispatcher(formatter, []interface{}{output})
+	if err != nil {
+		return nil, err
+	}
+
+	conf, err := newFullLoggerConfig(constraints, make([]*LogLevelException, 0), dispatcher, syncloggerTypeFromString, nil, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return createLoggerFromFullConfig(conf)
+}
+
+// LoggerFromXMLDecoder creates logger with config from a XML decoder starting from a specific node.
+// It should contain valid seelog xml, except for root node name.
+func LoggerFromXMLDecoder(xmlParser *xml.Decoder, rootNode xml.Token) (LoggerInterface, error) {
+	conf, err := configFromXMLDecoder(xmlParser, rootNode)
+	if err != nil {
+		return nil, err
+	}
+
+	return createLoggerFromFullConfig(conf)
+}
+
+// LoggerFromCustomReceiver creates a proxy logger that uses a CustomReceiver as the
+// receiver.
+//
+// All messages will be sent to the specified custom receiver without additional
+// formatting ('%Msg' format is used).
+//
+// Check CustomReceiver, RegisterReceiver for additional info.
+//
+// NOTE 1: CustomReceiver.AfterParse is only called when a receiver is instantiated
+// by the config parser while parsing config. So, if you are not planning to use the
+// same CustomReceiver for both proxying (via LoggerFromCustomReceiver call) and
+// loading from config, just leave AfterParse implementation empty.
+//
+// NOTE 2: Unlike RegisterReceiver, LoggerFromCustomReceiver takes an already initialized
+// instance that implements CustomReceiver. So, fill it with data and perform any initialization
+// logic before calling this func and it won't be lost.
+//
+// So:
+// * RegisterReceiver takes value just to get the reflect.Type from it and then
+// instantiate it as many times as config is reloaded.
+//
+// * LoggerFromCustomReceiver takes value and uses it without modification and
+// reinstantiation, directy passing it to the dispatcher tree.
+func LoggerFromCustomReceiver(receiver CustomReceiver) (LoggerInterface, error) {
+	constraints, err := NewMinMaxConstraints(TraceLvl, CriticalLvl)
+	if err != nil {
+		return nil, err
+	}
+
+	output, err := NewCustomReceiverDispatcherByValue(msgonlyformatter, receiver, "user-proxy", CustomReceiverInitArgs{})
+	if err != nil {
+		return nil, err
+	}
+	dispatcher, err := NewSplitDispatcher(msgonlyformatter, []interface{}{output})
+	if err != nil {
+		return nil, err
+	}
+
+	conf, err := newFullLoggerConfig(constraints, make([]*LogLevelException, 0), dispatcher, syncloggerTypeFromString, nil, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return createLoggerFromFullConfig(conf)
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/cfg_errors.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/cfg_errors.go
new file mode 100644
index 00000000..c1fb4d10
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/cfg_errors.go
@@ -0,0 +1,61 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"errors"
+)
+
+var (
+	errNodeMustHaveChildren   = errors.New("node must have children")
+	errNodeCannotHaveChildren = errors.New("node cannot have children")
+)
+
+type unexpectedChildElementError struct {
+	baseError
+}
+
+func newUnexpectedChildElementError(msg string) *unexpectedChildElementError {
+	custmsg := "Unexpected child element: " + msg
+	return &unexpectedChildElementError{baseError{message: custmsg}}
+}
+
+type missingArgumentError struct {
+	baseError
+}
+
+func newMissingArgumentError(nodeName, attrName string) *missingArgumentError {
+	custmsg := "Output '" + nodeName + "' has no '" + attrName + "' attribute"
+	return &missingArgumentError{baseError{message: custmsg}}
+}
+
+type unexpectedAttributeError struct {
+	baseError
+}
+
+func newUnexpectedAttributeError(nodeName, attr string) *unexpectedAttributeError {
+	custmsg := nodeName + " has unexpected attribute: " + attr
+	return &unexpectedAttributeError{baseError{message: custmsg}}
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/cfg_logconfig.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/cfg_logconfig.go
new file mode 100644
index 00000000..6ba6f9a9
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/cfg_logconfig.go
@@ -0,0 +1,141 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"errors"
+)
+
+type loggerTypeFromString uint8
+
+const (
+	syncloggerTypeFromString = iota
+	asyncLooploggerTypeFromString
+	asyncTimerloggerTypeFromString
+	adaptiveLoggerTypeFromString
+	defaultloggerTypeFromString = asyncLooploggerTypeFromString
+)
+
+const (
+	syncloggerTypeFromStringStr       = "sync"
+	asyncloggerTypeFromStringStr      = "asyncloop"
+	asyncTimerloggerTypeFromStringStr = "asynctimer"
+	adaptiveLoggerTypeFromStringStr   = "adaptive"
+)
+
+// asyncTimerLoggerData represents specific data for async timer logger
+type asyncTimerLoggerData struct {
+	AsyncInterval uint32
+}
+
+// adaptiveLoggerData represents specific data for adaptive timer logger
+type adaptiveLoggerData struct {
+	MinInterval      uint32
+	MaxInterval      uint32
+	CriticalMsgCount uint32
+}
+
+var loggerTypeToStringRepresentations = map[loggerTypeFromString]string{
+	syncloggerTypeFromString:       syncloggerTypeFromStringStr,
+	asyncLooploggerTypeFromString:  asyncloggerTypeFromStringStr,
+	asyncTimerloggerTypeFromString: asyncTimerloggerTypeFromStringStr,
+	adaptiveLoggerTypeFromString:   adaptiveLoggerTypeFromStringStr,
+}
+
+// getLoggerTypeFromString parses a string and returns a corresponding logger type, if successful.
+func getLoggerTypeFromString(logTypeString string) (level loggerTypeFromString, found bool) {
+	for logType, logTypeStr := range loggerTypeToStringRepresentations {
+		if logTypeStr == logTypeString {
+			return logType, true
+		}
+	}
+
+	return 0, false
+}
+
+// logConfig stores logging configuration. Contains messages dispatcher, allowed log level rules
+// (general constraints and exceptions)
+type logConfig struct {
+	Constraints    logLevelConstraints  // General log level rules (>min and <max, or set of allowed levels)
+	Exceptions     []*LogLevelException // Exceptions to general rules for specific files or funcs
+	RootDispatcher dispatcherInterface  // Root of output tree
+}
+
+func NewLoggerConfig(c logLevelConstraints, e []*LogLevelException, d dispatcherInterface) *logConfig {
+	return &logConfig{c, e, d}
+}
+
+// configForParsing is used when parsing config from file: logger type is deduced from string, params
+// need to be converted from attributes to values and passed to specific logger constructor. Also,
+// custom registered receivers and other parse params are used in this case.
+type configForParsing struct {
+	logConfig
+	LogType    loggerTypeFromString
+	LoggerData interface{}
+	Params     *CfgParseParams // Check cfg_parser: CfgParseParams
+}
+
+func newFullLoggerConfig(
+	constraints logLevelConstraints,
+	exceptions []*LogLevelException,
+	rootDispatcher dispatcherInterface,
+	logType loggerTypeFromString,
+	logData interface{},
+	cfgParams *CfgParseParams) (*configForParsing, error) {
+	if constraints == nil {
+		return nil, errors.New("constraints can not be nil")
+	}
+	if rootDispatcher == nil {
+		return nil, errors.New("rootDispatcher can not be nil")
+	}
+
+	config := new(configForParsing)
+	config.Constraints = constraints
+	config.Exceptions = exceptions
+	config.RootDispatcher = rootDispatcher
+	config.LogType = logType
+	config.LoggerData = logData
+	config.Params = cfgParams
+
+	return config, nil
+}
+
+// IsAllowed returns true if logging with specified log level is allowed in current context.
+// If any of exception patterns match current context, then exception constraints are applied. Otherwise,
+// the general constraints are used.
+func (config *logConfig) IsAllowed(level LogLevel, context LogContextInterface) bool {
+	allowed := config.Constraints.IsAllowed(level) // General rule
+
+	// Exceptions:
+	if context.IsValid() {
+		for _, exception := range config.Exceptions {
+			if exception.MatchesContext(context) {
+				return exception.IsAllowed(level)
+			}
+		}
+	}
+
+	return allowed
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/cfg_parser.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/cfg_parser.go
new file mode 100644
index 00000000..7fb9aabf
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/cfg_parser.go
@@ -0,0 +1,1238 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"crypto/tls"
+	"encoding/xml"
+	"errors"
+	"fmt"
+	"io"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// Names of elements of seelog config.
+const (
+	seelogConfigID                   = "seelog"
+	outputsID                        = "outputs"
+	formatsID                        = "formats"
+	minLevelID                       = "minlevel"
+	maxLevelID                       = "maxlevel"
+	levelsID                         = "levels"
+	exceptionsID                     = "exceptions"
+	exceptionID                      = "exception"
+	funcPatternID                    = "funcpattern"
+	filePatternID                    = "filepattern"
+	formatID                         = "format"
+	formatAttrID                     = "format"
+	formatKeyAttrID                  = "id"
+	outputFormatID                   = "formatid"
+	pathID                           = "path"
+	fileWriterID                     = "file"
+	smtpWriterID                     = "smtp"
+	senderaddressID                  = "senderaddress"
+	senderNameID                     = "sendername"
+	recipientID                      = "recipient"
+	mailHeaderID                     = "header"
+	mailHeaderNameID                 = "name"
+	mailHeaderValueID                = "value"
+	addressID                        = "address"
+	hostNameID                       = "hostname"
+	hostPortID                       = "hostport"
+	userNameID                       = "username"
+	userPassID                       = "password"
+	cACertDirpathID                  = "cacertdirpath"
+	subjectID                        = "subject"
+	splitterDispatcherID             = "splitter"
+	consoleWriterID                  = "console"
+	customReceiverID                 = "custom"
+	customNameAttrID                 = "name"
+	customNameDataAttrPrefix         = "data-"
+	filterDispatcherID               = "filter"
+	filterLevelsAttrID               = "levels"
+	rollingfileWriterID              = "rollingfile"
+	rollingFileTypeAttr              = "type"
+	rollingFilePathAttr              = "filename"
+	rollingFileMaxSizeAttr           = "maxsize"
+	rollingFileMaxRollsAttr          = "maxrolls"
+	rollingFileNameModeAttr          = "namemode"
+	rollingFileDataPatternAttr       = "datepattern"
+	rollingFileArchiveAttr           = "archivetype"
+	rollingFileArchivePathAttr       = "archivepath"
+	bufferedWriterID                 = "buffered"
+	bufferedSizeAttr                 = "size"
+	bufferedFlushPeriodAttr          = "flushperiod"
+	loggerTypeFromStringAttr         = "type"
+	asyncLoggerIntervalAttr          = "asyncinterval"
+	adaptLoggerMinIntervalAttr       = "mininterval"
+	adaptLoggerMaxIntervalAttr       = "maxinterval"
+	adaptLoggerCriticalMsgCountAttr  = "critmsgcount"
+	predefinedPrefix                 = "std:"
+	connWriterID                     = "conn"
+	connWriterAddrAttr               = "addr"
+	connWriterNetAttr                = "net"
+	connWriterReconnectOnMsgAttr     = "reconnectonmsg"
+	connWriterUseTLSAttr             = "tls"
+	connWriterInsecureSkipVerifyAttr = "insecureskipverify"
+)
+
+// CustomReceiverProducer is the signature of the function CfgParseParams needs to create
+// custom receivers.
+type CustomReceiverProducer func(CustomReceiverInitArgs) (CustomReceiver, error)
+
+// CfgParseParams represent specific parse options or flags used by parser. It is used if seelog parser needs
+// some special directives or additional info to correctly parse a config.
+type CfgParseParams struct {
+	// CustomReceiverProducers expose the same functionality as RegisterReceiver func
+	// but only in the scope (context) of the config parse func instead of a global package scope.
+	//
+	// It means that if you use custom receivers in your code, you may either register them globally once with
+	// RegisterReceiver or you may call funcs like LoggerFromParamConfigAsFile (with 'ParamConfig')
+	// and use CustomReceiverProducers to provide custom producer funcs.
+	//
+	// A producer func is called when config parser processes a '<custom>' element. It takes the 'name' attribute
+	// of the element and tries to find a match in two places:
+	// 1) CfgParseParams.CustomReceiverProducers map
+	// 2) Global type map, filled by RegisterReceiver
+	//
+	// If a match is found in the CustomReceiverProducers map, parser calls the corresponding producer func
+	// passing the init args to it.	The func takes exactly the same args as CustomReceiver.AfterParse.
+	// The producer func must return a correct receiver or an error. If case of error, seelog will behave
+	// in the same way as with any other config error.
+	//
+	// You may use this param to set custom producers in case you need to pass some context when instantiating
+	// a custom receiver or if you frequently change custom receivers with different parameters or in any other
+	// situation where package-level registering (RegisterReceiver) is not an option for you.
+	CustomReceiverProducers map[string]CustomReceiverProducer
+}
+
+func (cfg *CfgParseParams) String() string {
+	return fmt.Sprintf("CfgParams: {custom_recs=%d}", len(cfg.CustomReceiverProducers))
+}
+
+type elementMapEntry struct {
+	constructor func(node *xmlNode, formatFromParent *formatter, formats map[string]*formatter, cfg *CfgParseParams) (interface{}, error)
+}
+
+var elementMap map[string]elementMapEntry
+var predefinedFormats map[string]*formatter
+
+func init() {
+	elementMap = map[string]elementMapEntry{
+		fileWriterID:         {createfileWriter},
+		splitterDispatcherID: {createSplitter},
+		customReceiverID:     {createCustomReceiver},
+		filterDispatcherID:   {createFilter},
+		consoleWriterID:      {createConsoleWriter},
+		rollingfileWriterID:  {createRollingFileWriter},
+		bufferedWriterID:     {createbufferedWriter},
+		smtpWriterID:         {createSMTPWriter},
+		connWriterID:         {createconnWriter},
+	}
+
+	err := fillPredefinedFormats()
+	if err != nil {
+		panic(fmt.Sprintf("Seelog couldn't start: predefined formats creation failed. Error: %s", err.Error()))
+	}
+}
+
+func fillPredefinedFormats() error {
+	predefinedFormatsWithoutPrefix := map[string]string{
+		"xml-debug":       `<time>%Ns</time><lev>%Lev</lev><msg>%Msg</msg><path>%RelFile</path><func>%Func</func><line>%Line</line>`,
+		"xml-debug-short": `<t>%Ns</t><l>%l</l><m>%Msg</m><p>%RelFile</p><f>%Func</f>`,
+		"xml":             `<time>%Ns</time><lev>%Lev</lev><msg>%Msg</msg>`,
+		"xml-short":       `<t>%Ns</t><l>%l</l><m>%Msg</m>`,
+
+		"json-debug":       `{"time":%Ns,"lev":"%Lev","msg":"%Msg","path":"%RelFile","func":"%Func","line":"%Line"}`,
+		"json-debug-short": `{"t":%Ns,"l":"%Lev","m":"%Msg","p":"%RelFile","f":"%Func"}`,
+		"json":             `{"time":%Ns,"lev":"%Lev","msg":"%Msg"}`,
+		"json-short":       `{"t":%Ns,"l":"%Lev","m":"%Msg"}`,
+
+		"debug":       `[%LEVEL] %RelFile:%Func.%Line %Date %Time %Msg%n`,
+		"debug-short": `[%LEVEL] %Date %Time %Msg%n`,
+		"fast":        `%Ns %l %Msg%n`,
+	}
+
+	predefinedFormats = make(map[string]*formatter)
+
+	for formatKey, format := range predefinedFormatsWithoutPrefix {
+		formatter, err := NewFormatter(format)
+		if err != nil {
+			return err
+		}
+
+		predefinedFormats[predefinedPrefix+formatKey] = formatter
+	}
+
+	return nil
+}
+
+// configFromXMLDecoder parses data from a given XML decoder.
+// Returns parsed config which can be used to create logger in case no errors occured.
+// Returns error if format is incorrect or anything happened.
+func configFromXMLDecoder(xmlParser *xml.Decoder, rootNode xml.Token) (*configForParsing, error) {
+	return configFromXMLDecoderWithConfig(xmlParser, rootNode, nil)
+}
+
+// configFromXMLDecoderWithConfig parses data from a given XML decoder.
+// Returns parsed config which can be used to create logger in case no errors occured.
+// Returns error if format is incorrect or anything happened.
+func configFromXMLDecoderWithConfig(xmlParser *xml.Decoder, rootNode xml.Token, cfg *CfgParseParams) (*configForParsing, error) {
+	_, ok := rootNode.(xml.StartElement)
+	if !ok {
+		return nil, errors.New("rootNode must be XML startElement")
+	}
+
+	config, err := unmarshalNode(xmlParser, rootNode)
+	if err != nil {
+		return nil, err
+	}
+	if config == nil {
+		return nil, errors.New("xml has no content")
+	}
+
+	return configFromXMLNodeWithConfig(config, cfg)
+}
+
+// configFromReader parses data from a given reader.
+// Returns parsed config which can be used to create logger in case no errors occured.
+// Returns error if format is incorrect or anything happened.
+func configFromReader(reader io.Reader) (*configForParsing, error) {
+	return configFromReaderWithConfig(reader, nil)
+}
+
+// configFromReaderWithConfig parses data from a given reader.
+// Returns parsed config which can be used to create logger in case no errors occured.
+// Returns error if format is incorrect or anything happened.
+func configFromReaderWithConfig(reader io.Reader, cfg *CfgParseParams) (*configForParsing, error) {
+	config, err := unmarshalConfig(reader)
+	if err != nil {
+		return nil, err
+	}
+
+	if config.name != seelogConfigID {
+		return nil, errors.New("root xml tag must be '" + seelogConfigID + "'")
+	}
+
+	return configFromXMLNodeWithConfig(config, cfg)
+}
+
+func configFromXMLNodeWithConfig(config *xmlNode, cfg *CfgParseParams) (*configForParsing, error) {
+	err := checkUnexpectedAttribute(
+		config,
+		minLevelID,
+		maxLevelID,
+		levelsID,
+		loggerTypeFromStringAttr,
+		asyncLoggerIntervalAttr,
+		adaptLoggerMinIntervalAttr,
+		adaptLoggerMaxIntervalAttr,
+		adaptLoggerCriticalMsgCountAttr,
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	err = checkExpectedElements(config, optionalElement(outputsID), optionalElement(formatsID), optionalElement(exceptionsID))
+	if err != nil {
+		return nil, err
+	}
+
+	constraints, err := getConstraints(config)
+	if err != nil {
+		return nil, err
+	}
+
+	exceptions, err := getExceptions(config)
+	if err != nil {
+		return nil, err
+	}
+	err = checkDistinctExceptions(exceptions)
+	if err != nil {
+		return nil, err
+	}
+
+	formats, err := getFormats(config)
+	if err != nil {
+		return nil, err
+	}
+
+	dispatcher, err := getOutputsTree(config, formats, cfg)
+	if err != nil {
+		// If we open several files, but then fail to parse the config, we should close
+		// those files before reporting that config is invalid.
+		if dispatcher != nil {
+			dispatcher.Close()
+		}
+
+		return nil, err
+	}
+
+	loggerType, logData, err := getloggerTypeFromStringData(config)
+	if err != nil {
+		return nil, err
+	}
+
+	return newFullLoggerConfig(constraints, exceptions, dispatcher, loggerType, logData, cfg)
+}
+
+func getConstraints(node *xmlNode) (logLevelConstraints, error) {
+	minLevelStr, isMinLevel := node.attributes[minLevelID]
+	maxLevelStr, isMaxLevel := node.attributes[maxLevelID]
+	levelsStr, isLevels := node.attributes[levelsID]
+
+	if isLevels && (isMinLevel && isMaxLevel) {
+		return nil, errors.New("for level declaration use '" + levelsID + "'' OR '" + minLevelID +
+			"', '" + maxLevelID + "'")
+	}
+
+	offString := LogLevel(Off).String()
+
+	if (isLevels && strings.TrimSpace(levelsStr) == offString) ||
+		(isMinLevel && !isMaxLevel && minLevelStr == offString) {
+
+		return NewOffConstraints()
+	}
+
+	if isLevels {
+		levels, err := parseLevels(levelsStr)
+		if err != nil {
+			return nil, err
+		}
+		return NewListConstraints(levels)
+	}
+
+	var minLevel = LogLevel(TraceLvl)
+	if isMinLevel {
+		found := true
+		minLevel, found = LogLevelFromString(minLevelStr)
+		if !found {
+			return nil, errors.New("declared " + minLevelID + " not found: " + minLevelStr)
+		}
+	}
+
+	var maxLevel = LogLevel(CriticalLvl)
+	if isMaxLevel {
+		found := true
+		maxLevel, found = LogLevelFromString(maxLevelStr)
+		if !found {
+			return nil, errors.New("declared " + maxLevelID + " not found: " + maxLevelStr)
+		}
+	}
+
+	return NewMinMaxConstraints(minLevel, maxLevel)
+}
+
+func parseLevels(str string) ([]LogLevel, error) {
+	levelsStrArr := strings.Split(strings.Replace(str, " ", "", -1), ",")
+	var levels []LogLevel
+	for _, levelStr := range levelsStrArr {
+		level, found := LogLevelFromString(levelStr)
+		if !found {
+			return nil, errors.New("declared level not found: " + levelStr)
+		}
+
+		levels = append(levels, level)
+	}
+
+	return levels, nil
+}
+
+func getExceptions(config *xmlNode) ([]*LogLevelException, error) {
+	var exceptions []*LogLevelException
+
+	var exceptionsNode *xmlNode
+	for _, child := range config.children {
+		if child.name == exceptionsID {
+			exceptionsNode = child
+			break
+		}
+	}
+
+	if exceptionsNode == nil {
+		return exceptions, nil
+	}
+
+	err := checkUnexpectedAttribute(exceptionsNode)
+	if err != nil {
+		return nil, err
+	}
+
+	err = checkExpectedElements(exceptionsNode, multipleMandatoryElements("exception"))
+	if err != nil {
+		return nil, err
+	}
+
+	for _, exceptionNode := range exceptionsNode.children {
+		if exceptionNode.name != exceptionID {
+			return nil, errors.New("incorrect nested element in exceptions section: " + exceptionNode.name)
+		}
+
+		err := checkUnexpectedAttribute(exceptionNode, minLevelID, maxLevelID, levelsID, funcPatternID, filePatternID)
+		if err != nil {
+			return nil, err
+		}
+
+		constraints, err := getConstraints(exceptionNode)
+		if err != nil {
+			return nil, errors.New("incorrect " + exceptionsID + " node: " + err.Error())
+		}
+
+		funcPattern, isFuncPattern := exceptionNode.attributes[funcPatternID]
+		filePattern, isFilePattern := exceptionNode.attributes[filePatternID]
+		if !isFuncPattern {
+			funcPattern = "*"
+		}
+		if !isFilePattern {
+			filePattern = "*"
+		}
+
+		exception, err := NewLogLevelException(funcPattern, filePattern, constraints)
+		if err != nil {
+			return nil, errors.New("incorrect exception node: " + err.Error())
+		}
+
+		exceptions = append(exceptions, exception)
+	}
+
+	return exceptions, nil
+}
+
+func checkDistinctExceptions(exceptions []*LogLevelException) error {
+	for i, exception := range exceptions {
+		for j, exception1 := range exceptions {
+			if i == j {
+				continue
+			}
+
+			if exception.FuncPattern() == exception1.FuncPattern() &&
+				exception.FilePattern() == exception1.FilePattern() {
+
+				return fmt.Errorf("there are two or more duplicate exceptions. Func: %v, file %v",
+					exception.FuncPattern(), exception.FilePattern())
+			}
+		}
+	}
+
+	return nil
+}
+
+func getFormats(config *xmlNode) (map[string]*formatter, error) {
+	formats := make(map[string]*formatter, 0)
+
+	var formatsNode *xmlNode
+	for _, child := range config.children {
+		if child.name == formatsID {
+			formatsNode = child
+			break
+		}
+	}
+
+	if formatsNode == nil {
+		return formats, nil
+	}
+
+	err := checkUnexpectedAttribute(formatsNode)
+	if err != nil {
+		return nil, err
+	}
+
+	err = checkExpectedElements(formatsNode, multipleMandatoryElements("format"))
+	if err != nil {
+		return nil, err
+	}
+
+	for _, formatNode := range formatsNode.children {
+		if formatNode.name != formatID {
+			return nil, errors.New("incorrect nested element in " + formatsID + " section: " + formatNode.name)
+		}
+
+		err := checkUnexpectedAttribute(formatNode, formatKeyAttrID, formatID)
+		if err != nil {
+			return nil, err
+		}
+
+		id, isID := formatNode.attributes[formatKeyAttrID]
+		formatStr, isFormat := formatNode.attributes[formatAttrID]
+		if !isID {
+			return nil, errors.New("format has no '" + formatKeyAttrID + "' attribute")
+		}
+		if !isFormat {
+			return nil, errors.New("format[" + id + "] has no '" + formatAttrID + "' attribute")
+		}
+
+		formatter, err := NewFormatter(formatStr)
+		if err != nil {
+			return nil, err
+		}
+
+		formats[id] = formatter
+	}
+
+	return formats, nil
+}
+
+func getloggerTypeFromStringData(config *xmlNode) (logType loggerTypeFromString, logData interface{}, err error) {
+	logTypeStr, loggerTypeExists := config.attributes[loggerTypeFromStringAttr]
+
+	if !loggerTypeExists {
+		return defaultloggerTypeFromString, nil, nil
+	}
+
+	logType, found := getLoggerTypeFromString(logTypeStr)
+
+	if !found {
+		return 0, nil, fmt.Errorf("unknown logger type: %s", logTypeStr)
+	}
+
+	if logType == asyncTimerloggerTypeFromString {
+		intervalStr, intervalExists := config.attributes[asyncLoggerIntervalAttr]
+		if !intervalExists {
+			return 0, nil, newMissingArgumentError(config.name, asyncLoggerIntervalAttr)
+		}
+
+		interval, err := strconv.ParseUint(intervalStr, 10, 32)
+		if err != nil {
+			return 0, nil, err
+		}
+
+		logData = asyncTimerLoggerData{uint32(interval)}
+	} else if logType == adaptiveLoggerTypeFromString {
+
+		// Min interval
+		minIntStr, minIntExists := config.attributes[adaptLoggerMinIntervalAttr]
+		if !minIntExists {
+			return 0, nil, newMissingArgumentError(config.name, adaptLoggerMinIntervalAttr)
+		}
+		minInterval, err := strconv.ParseUint(minIntStr, 10, 32)
+		if err != nil {
+			return 0, nil, err
+		}
+
+		// Max interval
+		maxIntStr, maxIntExists := config.attributes[adaptLoggerMaxIntervalAttr]
+		if !maxIntExists {
+			return 0, nil, newMissingArgumentError(config.name, adaptLoggerMaxIntervalAttr)
+		}
+		maxInterval, err := strconv.ParseUint(maxIntStr, 10, 32)
+		if err != nil {
+			return 0, nil, err
+		}
+
+		// Critical msg count
+		criticalMsgCountStr, criticalMsgCountExists := config.attributes[adaptLoggerCriticalMsgCountAttr]
+		if !criticalMsgCountExists {
+			return 0, nil, newMissingArgumentError(config.name, adaptLoggerCriticalMsgCountAttr)
+		}
+		criticalMsgCount, err := strconv.ParseUint(criticalMsgCountStr, 10, 32)
+		if err != nil {
+			return 0, nil, err
+		}
+
+		logData = adaptiveLoggerData{uint32(minInterval), uint32(maxInterval), uint32(criticalMsgCount)}
+	}
+
+	return logType, logData, nil
+}
+
+func getOutputsTree(config *xmlNode, formats map[string]*formatter, cfg *CfgParseParams) (dispatcherInterface, error) {
+	var outputsNode *xmlNode
+	for _, child := range config.children {
+		if child.name == outputsID {
+			outputsNode = child
+			break
+		}
+	}
+
+	if outputsNode != nil {
+		err := checkUnexpectedAttribute(outputsNode, outputFormatID)
+		if err != nil {
+			return nil, err
+		}
+
+		formatter, err := getCurrentFormat(outputsNode, DefaultFormatter, formats)
+		if err != nil {
+			return nil, err
+		}
+
+		output, err := createSplitter(outputsNode, formatter, formats, cfg)
+		if err != nil {
+			return nil, err
+		}
+
+		dispatcher, ok := output.(dispatcherInterface)
+		if ok {
+			return dispatcher, nil
+		}
+	}
+
+	console, err := NewConsoleWriter()
+	if err != nil {
+		return nil, err
+	}
+	return NewSplitDispatcher(DefaultFormatter, []interface{}{console})
+}
+
+func getCurrentFormat(node *xmlNode, formatFromParent *formatter, formats map[string]*formatter) (*formatter, error) {
+	formatID, isFormatID := node.attributes[outputFormatID]
+	if !isFormatID {
+		return formatFromParent, nil
+	}
+
+	format, ok := formats[formatID]
+	if ok {
+		return format, nil
+	}
+
+	// Test for predefined format match
+	pdFormat, pdOk := predefinedFormats[formatID]
+
+	if !pdOk {
+		return nil, errors.New("formatid = '" + formatID + "' doesn't exist")
+	}
+
+	return pdFormat, nil
+}
+
+func createInnerReceivers(node *xmlNode, format *formatter, formats map[string]*formatter, cfg *CfgParseParams) ([]interface{}, error) {
+	var outputs []interface{}
+	for _, childNode := range node.children {
+		entry, ok := elementMap[childNode.name]
+		if !ok {
+			return nil, errors.New("unnknown tag '" + childNode.name + "' in outputs section")
+		}
+
+		output, err := entry.constructor(childNode, format, formats, cfg)
+		if err != nil {
+			return nil, err
+		}
+
+		outputs = append(outputs, output)
+	}
+
+	return outputs, nil
+}
+
+func createSplitter(node *xmlNode, formatFromParent *formatter, formats map[string]*formatter, cfg *CfgParseParams) (interface{}, error) {
+	err := checkUnexpectedAttribute(node, outputFormatID)
+	if err != nil {
+		return nil, err
+	}
+
+	if !node.hasChildren() {
+		return nil, errNodeMustHaveChildren
+	}
+
+	currentFormat, err := getCurrentFormat(node, formatFromParent, formats)
+	if err != nil {
+		return nil, err
+	}
+
+	receivers, err := createInnerReceivers(node, currentFormat, formats, cfg)
+	if err != nil {
+		return nil, err
+	}
+
+	return NewSplitDispatcher(currentFormat, receivers)
+}
+
+func createCustomReceiver(node *xmlNode, formatFromParent *formatter, formats map[string]*formatter, cfg *CfgParseParams) (interface{}, error) {
+	dataCustomPrefixes := make(map[string]string)
+	// Expecting only 'formatid', 'name' and 'data-' attrs
+	for attr, attrval := range node.attributes {
+		isExpected := false
+		if attr == outputFormatID ||
+			attr == customNameAttrID {
+			isExpected = true
+		}
+		if strings.HasPrefix(attr, customNameDataAttrPrefix) {
+			dataCustomPrefixes[attr[len(customNameDataAttrPrefix):]] = attrval
+			isExpected = true
+		}
+		if !isExpected {
+			return nil, newUnexpectedAttributeError(node.name, attr)
+		}
+	}
+
+	if node.hasChildren() {
+		return nil, errNodeCannotHaveChildren
+	}
+	customName, hasCustomName := node.attributes[customNameAttrID]
+	if !hasCustomName {
+		return nil, newMissingArgumentError(node.name, customNameAttrID)
+	}
+	currentFormat, err := getCurrentFormat(node, formatFromParent, formats)
+	if err != nil {
+		return nil, err
+	}
+	args := CustomReceiverInitArgs{
+		XmlCustomAttrs: dataCustomPrefixes,
+	}
+
+	if cfg != nil && cfg.CustomReceiverProducers != nil {
+		if prod, ok := cfg.CustomReceiverProducers[customName]; ok {
+			rec, err := prod(args)
+			if err != nil {
+				return nil, err
+			}
+			creceiver, err := NewCustomReceiverDispatcherByValue(currentFormat, rec, customName, args)
+			if err != nil {
+				return nil, err
+			}
+			err = rec.AfterParse(args)
+			if err != nil {
+				return nil, err
+			}
+			return creceiver, nil
+		}
+	}
+
+	return NewCustomReceiverDispatcher(currentFormat, customName, args)
+}
+
+func createFilter(node *xmlNode, formatFromParent *formatter, formats map[string]*formatter, cfg *CfgParseParams) (interface{}, error) {
+	err := checkUnexpectedAttribute(node, outputFormatID, filterLevelsAttrID)
+	if err != nil {
+		return nil, err
+	}
+
+	if !node.hasChildren() {
+		return nil, errNodeMustHaveChildren
+	}
+
+	currentFormat, err := getCurrentFormat(node, formatFromParent, formats)
+	if err != nil {
+		return nil, err
+	}
+
+	levelsStr, isLevels := node.attributes[filterLevelsAttrID]
+	if !isLevels {
+		return nil, newMissingArgumentError(node.name, filterLevelsAttrID)
+	}
+
+	levels, err := parseLevels(levelsStr)
+	if err != nil {
+		return nil, err
+	}
+
+	receivers, err := createInnerReceivers(node, currentFormat, formats, cfg)
+	if err != nil {
+		return nil, err
+	}
+
+	return NewFilterDispatcher(currentFormat, receivers, levels...)
+}
+
+func createfileWriter(node *xmlNode, formatFromParent *formatter, formats map[string]*formatter, cfg *CfgParseParams) (interface{}, error) {
+	err := checkUnexpectedAttribute(node, outputFormatID, pathID)
+	if err != nil {
+		return nil, err
+	}
+
+	if node.hasChildren() {
+		return nil, errNodeCannotHaveChildren
+	}
+
+	currentFormat, err := getCurrentFormat(node, formatFromParent, formats)
+	if err != nil {
+		return nil, err
+	}
+
+	path, isPath := node.attributes[pathID]
+	if !isPath {
+		return nil, newMissingArgumentError(node.name, pathID)
+	}
+
+	fileWriter, err := NewFileWriter(path)
+	if err != nil {
+		return nil, err
+	}
+
+	return NewFormattedWriter(fileWriter, currentFormat)
+}
+
+// Creates new SMTP writer if encountered in the config file.
+func createSMTPWriter(node *xmlNode, formatFromParent *formatter, formats map[string]*formatter, cfg *CfgParseParams) (interface{}, error) {
+	err := checkUnexpectedAttribute(node, outputFormatID, senderaddressID, senderNameID, hostNameID, hostPortID, userNameID, userPassID, subjectID)
+	if err != nil {
+		return nil, err
+	}
+	// Node must have children.
+	if !node.hasChildren() {
+		return nil, errNodeMustHaveChildren
+	}
+	currentFormat, err := getCurrentFormat(node, formatFromParent, formats)
+	if err != nil {
+		return nil, err
+	}
+	senderAddress, ok := node.attributes[senderaddressID]
+	if !ok {
+		return nil, newMissingArgumentError(node.name, senderaddressID)
+	}
+	senderName, ok := node.attributes[senderNameID]
+	if !ok {
+		return nil, newMissingArgumentError(node.name, senderNameID)
+	}
+	// Process child nodes scanning for recipient email addresses and/or CA certificate paths.
+	var recipientAddresses []string
+	var caCertDirPaths []string
+	var mailHeaders []string
+	for _, childNode := range node.children {
+		switch childNode.name {
+		// Extract recipient address from child nodes.
+		case recipientID:
+			address, ok := childNode.attributes[addressID]
+			if !ok {
+				return nil, newMissingArgumentError(childNode.name, addressID)
+			}
+			recipientAddresses = append(recipientAddresses, address)
+		// Extract CA certificate file path from child nodes.
+		case cACertDirpathID:
+			path, ok := childNode.attributes[pathID]
+			if !ok {
+				return nil, newMissingArgumentError(childNode.name, pathID)
+			}
+			caCertDirPaths = append(caCertDirPaths, path)
+
+		// Extract email headers from child nodes.
+		case mailHeaderID:
+			headerName, ok := childNode.attributes[mailHeaderNameID]
+			if !ok {
+				return nil, newMissingArgumentError(childNode.name, mailHeaderNameID)
+			}
+
+			headerValue, ok := childNode.attributes[mailHeaderValueID]
+			if !ok {
+				return nil, newMissingArgumentError(childNode.name, mailHeaderValueID)
+			}
+
+			// Build header line
+			mailHeaders = append(mailHeaders, fmt.Sprintf("%s: %s", headerName, headerValue))
+		default:
+			return nil, newUnexpectedChildElementError(childNode.name)
+		}
+	}
+	hostName, ok := node.attributes[hostNameID]
+	if !ok {
+		return nil, newMissingArgumentError(node.name, hostNameID)
+	}
+
+	hostPort, ok := node.attributes[hostPortID]
+	if !ok {
+		return nil, newMissingArgumentError(node.name, hostPortID)
+	}
+
+	// Check if the string can really be converted into int.
+	if _, err := strconv.Atoi(hostPort); err != nil {
+		return nil, errors.New("invalid host port number")
+	}
+
+	userName, ok := node.attributes[userNameID]
+	if !ok {
+		return nil, newMissingArgumentError(node.name, userNameID)
+	}
+
+	userPass, ok := node.attributes[userPassID]
+	if !ok {
+		return nil, newMissingArgumentError(node.name, userPassID)
+	}
+
+	// subject is optionally set by configuration.
+	// default value is defined by DefaultSubjectPhrase constant in the writers_smtpwriter.go
+	var subjectPhrase = DefaultSubjectPhrase
+
+	subject, ok := node.attributes[subjectID]
+	if ok {
+		subjectPhrase = subject
+	}
+
+	smtpWriter := NewSMTPWriter(
+		senderAddress,
+		senderName,
+		recipientAddresses,
+		hostName,
+		hostPort,
+		userName,
+		userPass,
+		caCertDirPaths,
+		subjectPhrase,
+		mailHeaders,
+	)
+
+	return NewFormattedWriter(smtpWriter, currentFormat)
+}
+
+func createConsoleWriter(node *xmlNode, formatFromParent *formatter, formats map[string]*formatter, cfg *CfgParseParams) (interface{}, error) {
+	err := checkUnexpectedAttribute(node, outputFormatID)
+	if err != nil {
+		return nil, err
+	}
+
+	if node.hasChildren() {
+		return nil, errNodeCannotHaveChildren
+	}
+
+	currentFormat, err := getCurrentFormat(node, formatFromParent, formats)
+	if err != nil {
+		return nil, err
+	}
+
+	consoleWriter, err := NewConsoleWriter()
+	if err != nil {
+		return nil, err
+	}
+
+	return NewFormattedWriter(consoleWriter, currentFormat)
+}
+
+func createconnWriter(node *xmlNode, formatFromParent *formatter, formats map[string]*formatter, cfg *CfgParseParams) (interface{}, error) {
+	if node.hasChildren() {
+		return nil, errNodeCannotHaveChildren
+	}
+
+	err := checkUnexpectedAttribute(node, outputFormatID, connWriterAddrAttr, connWriterNetAttr, connWriterReconnectOnMsgAttr, connWriterUseTLSAttr, connWriterInsecureSkipVerifyAttr)
+	if err != nil {
+		return nil, err
+	}
+
+	currentFormat, err := getCurrentFormat(node, formatFromParent, formats)
+	if err != nil {
+		return nil, err
+	}
+
+	addr, isAddr := node.attributes[connWriterAddrAttr]
+	if !isAddr {
+		return nil, newMissingArgumentError(node.name, connWriterAddrAttr)
+	}
+
+	net, isNet := node.attributes[connWriterNetAttr]
+	if !isNet {
+		return nil, newMissingArgumentError(node.name, connWriterNetAttr)
+	}
+
+	reconnectOnMsg := false
+	reconnectOnMsgStr, isReconnectOnMsgStr := node.attributes[connWriterReconnectOnMsgAttr]
+	if isReconnectOnMsgStr {
+		if reconnectOnMsgStr == "true" {
+			reconnectOnMsg = true
+		} else if reconnectOnMsgStr == "false" {
+			reconnectOnMsg = false
+		} else {
+			return nil, errors.New("node '" + node.name + "' has incorrect '" + connWriterReconnectOnMsgAttr + "' attribute value")
+		}
+	}
+
+	useTLS := false
+	useTLSStr, isUseTLSStr := node.attributes[connWriterUseTLSAttr]
+	if isUseTLSStr {
+		if useTLSStr == "true" {
+			useTLS = true
+		} else if useTLSStr == "false" {
+			useTLS = false
+		} else {
+			return nil, errors.New("node '" + node.name + "' has incorrect '" + connWriterUseTLSAttr + "' attribute value")
+		}
+		if useTLS {
+			insecureSkipVerify := false
+			insecureSkipVerifyStr, isInsecureSkipVerify := node.attributes[connWriterInsecureSkipVerifyAttr]
+			if isInsecureSkipVerify {
+				if insecureSkipVerifyStr == "true" {
+					insecureSkipVerify = true
+				} else if insecureSkipVerifyStr == "false" {
+					insecureSkipVerify = false
+				} else {
+					return nil, errors.New("node '" + node.name + "' has incorrect '" + connWriterInsecureSkipVerifyAttr + "' attribute value")
+				}
+			}
+			config := tls.Config{InsecureSkipVerify: insecureSkipVerify}
+			connWriter := newTLSWriter(net, addr, reconnectOnMsg, &config)
+			return NewFormattedWriter(connWriter, currentFormat)
+		}
+	}
+
+	connWriter := NewConnWriter(net, addr, reconnectOnMsg)
+
+	return NewFormattedWriter(connWriter, currentFormat)
+}
+
+func createRollingFileWriter(node *xmlNode, formatFromParent *formatter, formats map[string]*formatter, cfg *CfgParseParams) (interface{}, error) {
+	if node.hasChildren() {
+		return nil, errNodeCannotHaveChildren
+	}
+
+	rollingTypeStr, isRollingType := node.attributes[rollingFileTypeAttr]
+	if !isRollingType {
+		return nil, newMissingArgumentError(node.name, rollingFileTypeAttr)
+	}
+
+	rollingType, ok := rollingTypeFromString(rollingTypeStr)
+	if !ok {
+		return nil, errors.New("unknown rolling file type: " + rollingTypeStr)
+	}
+
+	currentFormat, err := getCurrentFormat(node, formatFromParent, formats)
+	if err != nil {
+		return nil, err
+	}
+
+	path, isPath := node.attributes[rollingFilePathAttr]
+	if !isPath {
+		return nil, newMissingArgumentError(node.name, rollingFilePathAttr)
+	}
+
+	rollingArchiveStr, archiveAttrExists := node.attributes[rollingFileArchiveAttr]
+
+	var rArchiveType rollingArchiveType
+	var rArchivePath string
+	if !archiveAttrExists {
+		rArchiveType = rollingArchiveNone
+		rArchivePath = ""
+	} else {
+		rArchiveType, ok = rollingArchiveTypeFromString(rollingArchiveStr)
+		if !ok {
+			return nil, errors.New("unknown rolling archive type: " + rollingArchiveStr)
+		}
+
+		if rArchiveType == rollingArchiveNone {
+			rArchivePath = ""
+		} else {
+			rArchivePath, ok = node.attributes[rollingFileArchivePathAttr]
+			if !ok {
+				rArchivePath, ok = rollingArchiveTypesDefaultNames[rArchiveType]
+				if !ok {
+					return nil, fmt.Errorf("cannot get default filename for archive type = %v",
+						rArchiveType)
+				}
+			}
+		}
+	}
+
+	nameMode := rollingNameMode(rollingNameModePostfix)
+	nameModeStr, ok := node.attributes[rollingFileNameModeAttr]
+	if ok {
+		mode, found := rollingNameModeFromString(nameModeStr)
+		if !found {
+			return nil, errors.New("unknown rolling filename mode: " + nameModeStr)
+		} else {
+			nameMode = mode
+		}
+	}
+
+	if rollingType == rollingTypeSize {
+		err := checkUnexpectedAttribute(node, outputFormatID, rollingFileTypeAttr, rollingFilePathAttr,
+			rollingFileMaxSizeAttr, rollingFileMaxRollsAttr, rollingFileArchiveAttr,
+			rollingFileArchivePathAttr, rollingFileNameModeAttr)
+		if err != nil {
+			return nil, err
+		}
+
+		maxSizeStr, ok := node.attributes[rollingFileMaxSizeAttr]
+		if !ok {
+			return nil, newMissingArgumentError(node.name, rollingFileMaxSizeAttr)
+		}
+
+		maxSize, err := strconv.ParseInt(maxSizeStr, 10, 64)
+		if err != nil {
+			return nil, err
+		}
+
+		maxRolls := 0
+		maxRollsStr, ok := node.attributes[rollingFileMaxRollsAttr]
+		if ok {
+			maxRolls, err = strconv.Atoi(maxRollsStr)
+			if err != nil {
+				return nil, err
+			}
+		}
+
+		rollingWriter, err := NewRollingFileWriterSize(path, rArchiveType, rArchivePath, maxSize, maxRolls, nameMode)
+		if err != nil {
+			return nil, err
+		}
+
+		return NewFormattedWriter(rollingWriter, currentFormat)
+
+	} else if rollingType == rollingTypeTime {
+		err := checkUnexpectedAttribute(node, outputFormatID, rollingFileTypeAttr, rollingFilePathAttr,
+			rollingFileDataPatternAttr, rollingFileArchiveAttr, rollingFileMaxRollsAttr,
+			rollingFileArchivePathAttr, rollingFileNameModeAttr)
+		if err != nil {
+			return nil, err
+		}
+
+		maxRolls := 0
+		maxRollsStr, ok := node.attributes[rollingFileMaxRollsAttr]
+		if ok {
+			maxRolls, err = strconv.Atoi(maxRollsStr)
+			if err != nil {
+				return nil, err
+			}
+		}
+
+		dataPattern, ok := node.attributes[rollingFileDataPatternAttr]
+		if !ok {
+			return nil, newMissingArgumentError(node.name, rollingFileDataPatternAttr)
+		}
+
+		rollingWriter, err := NewRollingFileWriterTime(path, rArchiveType, rArchivePath, maxRolls, dataPattern, rollingIntervalAny, nameMode)
+		if err != nil {
+			return nil, err
+		}
+
+		return NewFormattedWriter(rollingWriter, currentFormat)
+	}
+
+	return nil, errors.New("incorrect rolling writer type " + rollingTypeStr)
+}
+
+func createbufferedWriter(node *xmlNode, formatFromParent *formatter, formats map[string]*formatter, cfg *CfgParseParams) (interface{}, error) {
+	err := checkUnexpectedAttribute(node, outputFormatID, bufferedSizeAttr, bufferedFlushPeriodAttr)
+	if err != nil {
+		return nil, err
+	}
+
+	if !node.hasChildren() {
+		return nil, errNodeMustHaveChildren
+	}
+
+	currentFormat, err := getCurrentFormat(node, formatFromParent, formats)
+	if err != nil {
+		return nil, err
+	}
+
+	sizeStr, isSize := node.attributes[bufferedSizeAttr]
+	if !isSize {
+		return nil, newMissingArgumentError(node.name, bufferedSizeAttr)
+	}
+
+	size, err := strconv.Atoi(sizeStr)
+	if err != nil {
+		return nil, err
+	}
+
+	flushPeriod := 0
+	flushPeriodStr, isFlushPeriod := node.attributes[bufferedFlushPeriodAttr]
+	if isFlushPeriod {
+		flushPeriod, err = strconv.Atoi(flushPeriodStr)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	// Inner writer couldn't have its own format, so we pass 'currentFormat' as its parent format
+	receivers, err := createInnerReceivers(node, currentFormat, formats, cfg)
+	if err != nil {
+		return nil, err
+	}
+
+	formattedWriter, ok := receivers[0].(*formattedWriter)
+	if !ok {
+		return nil, errors.New("buffered writer's child is not writer")
+	}
+
+	// ... and then we check that it hasn't changed
+	if formattedWriter.Format() != currentFormat {
+		return nil, errors.New("inner writer cannot have his own format")
+	}
+
+	bufferedWriter, err := NewBufferedWriter(formattedWriter.Writer(), size, time.Duration(flushPeriod))
+	if err != nil {
+		return nil, err
+	}
+
+	return NewFormattedWriter(bufferedWriter, currentFormat)
+}
+
+// Returns an error if node has any attributes not listed in expectedAttrs.
+func checkUnexpectedAttribute(node *xmlNode, expectedAttrs ...string) error {
+	for attr := range node.attributes {
+		isExpected := false
+		for _, expected := range expectedAttrs {
+			if attr == expected {
+				isExpected = true
+				break
+			}
+		}
+		if !isExpected {
+			return newUnexpectedAttributeError(node.name, attr)
+		}
+	}
+
+	return nil
+}
+
+type expectedElementInfo struct {
+	name      string
+	mandatory bool
+	multiple  bool
+}
+
+func optionalElement(name string) expectedElementInfo {
+	return expectedElementInfo{name, false, false}
+}
+func mandatoryElement(name string) expectedElementInfo {
+	return expectedElementInfo{name, true, false}
+}
+func multipleElements(name string) expectedElementInfo {
+	return expectedElementInfo{name, false, true}
+}
+func multipleMandatoryElements(name string) expectedElementInfo {
+	return expectedElementInfo{name, true, true}
+}
+
+func checkExpectedElements(node *xmlNode, elements ...expectedElementInfo) error {
+	for _, element := range elements {
+		count := 0
+		for _, child := range node.children {
+			if child.name == element.name {
+				count++
+			}
+		}
+
+		if count == 0 && element.mandatory {
+			return errors.New(node.name + " does not have mandatory subnode - " + element.name)
+		}
+		if count > 1 && !element.multiple {
+			return errors.New(node.name + " has more then one subnode - " + element.name)
+		}
+	}
+
+	for _, child := range node.children {
+		isExpected := false
+		for _, element := range elements {
+			if child.name == element.name {
+				isExpected = true
+			}
+		}
+
+		if !isExpected {
+			return errors.New(node.name + " has unexpected child: " + child.name)
+		}
+	}
+
+	return nil
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/common_closer.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/common_closer.go
new file mode 100644
index 00000000..1319c221
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/common_closer.go
@@ -0,0 +1,25 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/common_constraints.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/common_constraints.go
new file mode 100644
index 00000000..7ec2fe5b
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/common_constraints.go
@@ -0,0 +1,162 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+)
+
+// Represents constraints which form a general rule for log levels selection
+type logLevelConstraints interface {
+	IsAllowed(level LogLevel) bool
+}
+
+// A minMaxConstraints represents constraints which use minimal and maximal allowed log levels.
+type minMaxConstraints struct {
+	min LogLevel
+	max LogLevel
+}
+
+// NewMinMaxConstraints creates a new minMaxConstraints struct with the specified min and max levels.
+func NewMinMaxConstraints(min LogLevel, max LogLevel) (*minMaxConstraints, error) {
+	if min > max {
+		return nil, fmt.Errorf("min level can't be greater than max. Got min: %d, max: %d", min, max)
+	}
+	if min < TraceLvl || min > CriticalLvl {
+		return nil, fmt.Errorf("min level can't be less than Trace or greater than Critical. Got min: %d", min)
+	}
+	if max < TraceLvl || max > CriticalLvl {
+		return nil, fmt.Errorf("max level can't be less than Trace or greater than Critical. Got max: %d", max)
+	}
+
+	return &minMaxConstraints{min, max}, nil
+}
+
+// IsAllowed returns true, if log level is in [min, max] range (inclusive).
+func (minMaxConstr *minMaxConstraints) IsAllowed(level LogLevel) bool {
+	return level >= minMaxConstr.min && level <= minMaxConstr.max
+}
+
+func (minMaxConstr *minMaxConstraints) String() string {
+	return fmt.Sprintf("Min: %s. Max: %s", minMaxConstr.min, minMaxConstr.max)
+}
+
+//=======================================================
+
+// A listConstraints represents constraints which use allowed log levels list.
+type listConstraints struct {
+	allowedLevels map[LogLevel]bool
+}
+
+// NewListConstraints creates a new listConstraints struct with the specified allowed levels.
+func NewListConstraints(allowList []LogLevel) (*listConstraints, error) {
+	if allowList == nil {
+		return nil, errors.New("list can't be nil")
+	}
+
+	allowLevels, err := createMapFromList(allowList)
+	if err != nil {
+		return nil, err
+	}
+	err = validateOffLevel(allowLevels)
+	if err != nil {
+		return nil, err
+	}
+
+	return &listConstraints{allowLevels}, nil
+}
+
+func (listConstr *listConstraints) String() string {
+	allowedList := "List: "
+
+	listLevel := make([]string, len(listConstr.allowedLevels))
+
+	var logLevel LogLevel
+	i := 0
+	for logLevel = TraceLvl; logLevel <= Off; logLevel++ {
+		if listConstr.allowedLevels[logLevel] {
+			listLevel[i] = logLevel.String()
+			i++
+		}
+	}
+
+	allowedList += strings.Join(listLevel, ",")
+
+	return allowedList
+}
+
+func createMapFromList(allowedList []LogLevel) (map[LogLevel]bool, error) {
+	allowedLevels := make(map[LogLevel]bool, 0)
+	for _, level := range allowedList {
+		if level < TraceLvl || level > Off {
+			return nil, fmt.Errorf("level can't be less than Trace or greater than Critical. Got level: %d", level)
+		}
+		allowedLevels[level] = true
+	}
+	return allowedLevels, nil
+}
+func validateOffLevel(allowedLevels map[LogLevel]bool) error {
+	if _, ok := allowedLevels[Off]; ok && len(allowedLevels) > 1 {
+		return errors.New("logLevel Off cant be mixed with other levels")
+	}
+
+	return nil
+}
+
+// IsAllowed returns true, if log level is in allowed log levels list.
+// If the list contains the only item 'common.Off' then IsAllowed will always return false for any input values.
+func (listConstr *listConstraints) IsAllowed(level LogLevel) bool {
+	for l := range listConstr.allowedLevels {
+		if l == level && level != Off {
+			return true
+		}
+	}
+
+	return false
+}
+
+// AllowedLevels returns allowed levels configuration as a map.
+func (listConstr *listConstraints) AllowedLevels() map[LogLevel]bool {
+	return listConstr.allowedLevels
+}
+
+//=======================================================
+
+type offConstraints struct {
+}
+
+func NewOffConstraints() (*offConstraints, error) {
+	return &offConstraints{}, nil
+}
+
+func (offConstr *offConstraints) IsAllowed(level LogLevel) bool {
+	return false
+}
+
+func (offConstr *offConstraints) String() string {
+	return "Off constraint"
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/common_context.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/common_context.go
new file mode 100644
index 00000000..04bc2235
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/common_context.go
@@ -0,0 +1,194 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"time"
+)
+
+var workingDir = "/"
+
+func init() {
+	wd, err := os.Getwd()
+	if err == nil {
+		workingDir = filepath.ToSlash(wd) + "/"
+	}
+}
+
+// Represents runtime caller context.
+type LogContextInterface interface {
+	// Caller's function name.
+	Func() string
+	// Caller's line number.
+	Line() int
+	// Caller's file short path (in slashed form).
+	ShortPath() string
+	// Caller's file full path (in slashed form).
+	FullPath() string
+	// Caller's file name (without path).
+	FileName() string
+	// True if the context is correct and may be used.
+	// If false, then an error in context evaluation occurred and
+	// all its other data may be corrupted.
+	IsValid() bool
+	// Time when log function was called.
+	CallTime() time.Time
+	// Custom context that can be set by calling logger.SetContext
+	CustomContext() interface{}
+}
+
+// Returns context of the caller
+func currentContext(custom interface{}) (LogContextInterface, error) {
+	return specifyContext(1, custom)
+}
+
+func extractCallerInfo(skip int) (fullPath string, shortPath string, funcName string, line int, err error) {
+	pc, fp, ln, ok := runtime.Caller(skip)
+	if !ok {
+		err = fmt.Errorf("error during runtime.Caller")
+		return
+	}
+	line = ln
+	fullPath = fp
+	if strings.HasPrefix(fp, workingDir) {
+		shortPath = fp[len(workingDir):]
+	} else {
+		shortPath = fp
+	}
+	funcName = runtime.FuncForPC(pc).Name()
+	if strings.HasPrefix(funcName, workingDir) {
+		funcName = funcName[len(workingDir):]
+	}
+	return
+}
+
+// Returns context of the function with placed "skip" stack frames of the caller
+// If skip == 0 then behaves like currentContext
+// Context is returned in any situation, even if error occurs. But, if an error
+// occurs, the returned context is an error context, which contains no paths
+// or names, but states that they can't be extracted.
+func specifyContext(skip int, custom interface{}) (LogContextInterface, error) {
+	callTime := time.Now()
+	if skip < 0 {
+		err := fmt.Errorf("can not skip negative stack frames")
+		return &errorContext{callTime, err}, err
+	}
+	fullPath, shortPath, funcName, line, err := extractCallerInfo(skip + 2)
+	if err != nil {
+		return &errorContext{callTime, err}, err
+	}
+	_, fileName := filepath.Split(fullPath)
+	return &logContext{funcName, line, shortPath, fullPath, fileName, callTime, custom}, nil
+}
+
+// Represents a normal runtime caller context.
+type logContext struct {
+	funcName  string
+	line      int
+	shortPath string
+	fullPath  string
+	fileName  string
+	callTime  time.Time
+	custom    interface{}
+}
+
+func (context *logContext) IsValid() bool {
+	return true
+}
+
+func (context *logContext) Func() string {
+	return context.funcName
+}
+
+func (context *logContext) Line() int {
+	return context.line
+}
+
+func (context *logContext) ShortPath() string {
+	return context.shortPath
+}
+
+func (context *logContext) FullPath() string {
+	return context.fullPath
+}
+
+func (context *logContext) FileName() string {
+	return context.fileName
+}
+
+func (context *logContext) CallTime() time.Time {
+	return context.callTime
+}
+
+func (context *logContext) CustomContext() interface{} {
+	return context.custom
+}
+
+// Represents an error context
+type errorContext struct {
+	errorTime time.Time
+	err       error
+}
+
+func (errContext *errorContext) getErrorText(prefix string) string {
+	return fmt.Sprintf("%s() error: %s", prefix, errContext.err)
+}
+
+func (errContext *errorContext) IsValid() bool {
+	return false
+}
+
+func (errContext *errorContext) Line() int {
+	return -1
+}
+
+func (errContext *errorContext) Func() string {
+	return errContext.getErrorText("Func")
+}
+
+func (errContext *errorContext) ShortPath() string {
+	return errContext.getErrorText("ShortPath")
+}
+
+func (errContext *errorContext) FullPath() string {
+	return errContext.getErrorText("FullPath")
+}
+
+func (errContext *errorContext) FileName() string {
+	return errContext.getErrorText("FileName")
+}
+
+func (errContext *errorContext) CallTime() time.Time {
+	return errContext.errorTime
+}
+
+func (errContext *errorContext) CustomContext() interface{} {
+	return nil
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/common_exception.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/common_exception.go
new file mode 100644
index 00000000..9acc2750
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/common_exception.go
@@ -0,0 +1,194 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"errors"
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+// Used in rules creation to validate input file and func filters
+var (
+	fileFormatValidator = regexp.MustCompile(`[a-zA-Z0-9\\/ _\*\.]*`)
+	funcFormatValidator = regexp.MustCompile(`[a-zA-Z0-9_\*\.]*`)
+)
+
+// LogLevelException represents an exceptional case used when you need some specific files or funcs to
+// override general constraints and to use their own.
+type LogLevelException struct {
+	funcPatternParts []string
+	filePatternParts []string
+
+	funcPattern string
+	filePattern string
+
+	constraints logLevelConstraints
+}
+
+// NewLogLevelException creates a new exception.
+func NewLogLevelException(funcPattern string, filePattern string, constraints logLevelConstraints) (*LogLevelException, error) {
+	if constraints == nil {
+		return nil, errors.New("constraints can not be nil")
+	}
+
+	exception := new(LogLevelException)
+
+	err := exception.initFuncPatternParts(funcPattern)
+	if err != nil {
+		return nil, err
+	}
+	exception.funcPattern = strings.Join(exception.funcPatternParts, "")
+
+	err = exception.initFilePatternParts(filePattern)
+	if err != nil {
+		return nil, err
+	}
+	exception.filePattern = strings.Join(exception.filePatternParts, "")
+
+	exception.constraints = constraints
+
+	return exception, nil
+}
+
+// MatchesContext returns true if context matches the patterns of this LogLevelException
+func (logLevelEx *LogLevelException) MatchesContext(context LogContextInterface) bool {
+	return logLevelEx.match(context.Func(), context.FullPath())
+}
+
+// IsAllowed returns true if log level is allowed according to the constraints of this LogLevelException
+func (logLevelEx *LogLevelException) IsAllowed(level LogLevel) bool {
+	return logLevelEx.constraints.IsAllowed(level)
+}
+
+// FuncPattern returns the function pattern of a exception
+func (logLevelEx *LogLevelException) FuncPattern() string {
+	return logLevelEx.funcPattern
+}
+
+// FuncPattern returns the file pattern of a exception
+func (logLevelEx *LogLevelException) FilePattern() string {
+	return logLevelEx.filePattern
+}
+
+// initFuncPatternParts checks whether the func filter has a correct format and splits funcPattern on parts
+func (logLevelEx *LogLevelException) initFuncPatternParts(funcPattern string) (err error) {
+
+	if funcFormatValidator.FindString(funcPattern) != funcPattern {
+		return errors.New("func path \"" + funcPattern + "\" contains incorrect symbols. Only a-z A-Z 0-9 _ * . allowed)")
+	}
+
+	logLevelEx.funcPatternParts = splitPattern(funcPattern)
+	return nil
+}
+
+// Checks whether the file filter has a correct format and splits file patterns using splitPattern.
+func (logLevelEx *LogLevelException) initFilePatternParts(filePattern string) (err error) {
+
+	if fileFormatValidator.FindString(filePattern) != filePattern {
+		return errors.New("file path \"" + filePattern + "\" contains incorrect symbols. Only a-z A-Z 0-9 \\ / _ * . allowed)")
+	}
+
+	logLevelEx.filePatternParts = splitPattern(filePattern)
+	return err
+}
+
+func (logLevelEx *LogLevelException) match(funcPath string, filePath string) bool {
+	if !stringMatchesPattern(logLevelEx.funcPatternParts, funcPath) {
+		return false
+	}
+	return stringMatchesPattern(logLevelEx.filePatternParts, filePath)
+}
+
+func (logLevelEx *LogLevelException) String() string {
+	str := fmt.Sprintf("Func: %s File: %s", logLevelEx.funcPattern, logLevelEx.filePattern)
+
+	if logLevelEx.constraints != nil {
+		str += fmt.Sprintf("Constr: %s", logLevelEx.constraints)
+	} else {
+		str += "nil"
+	}
+
+	return str
+}
+
+// splitPattern splits pattern into strings and asterisks. Example: "ab*cde**f" -> ["ab", "*", "cde", "*", "f"]
+func splitPattern(pattern string) []string {
+	var patternParts []string
+	var lastChar rune
+	for _, char := range pattern {
+		if char == '*' {
+			if lastChar != '*' {
+				patternParts = append(patternParts, "*")
+			}
+		} else {
+			if len(patternParts) != 0 && lastChar != '*' {
+				patternParts[len(patternParts)-1] += string(char)
+			} else {
+				patternParts = append(patternParts, string(char))
+			}
+		}
+		lastChar = char
+	}
+
+	return patternParts
+}
+
+// stringMatchesPattern check whether testString matches pattern with asterisks.
+// Standard regexp functionality is not used here because of performance issues.
+func stringMatchesPattern(patternparts []string, testString string) bool {
+	if len(patternparts) == 0 {
+		return len(testString) == 0
+	}
+
+	part := patternparts[0]
+	if part != "*" {
+		index := strings.Index(testString, part)
+		if index == 0 {
+			return stringMatchesPattern(patternparts[1:], testString[len(part):])
+		}
+	} else {
+		if len(patternparts) == 1 {
+			return true
+		}
+
+		newTestString := testString
+		part = patternparts[1]
+		for {
+			index := strings.Index(newTestString, part)
+			if index == -1 {
+				break
+			}
+
+			newTestString = newTestString[index+len(part):]
+			result := stringMatchesPattern(patternparts[2:], newTestString)
+			if result {
+				return true
+			}
+		}
+	}
+	return false
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/common_flusher.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/common_flusher.go
new file mode 100644
index 00000000..0ef077c8
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/common_flusher.go
@@ -0,0 +1,31 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+// flusherInterface represents all objects that have to do cleanup
+// at certain moments of time (e.g. before app shutdown to avoid data loss)
+type flusherInterface interface {
+	Flush()
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/common_loglevel.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/common_loglevel.go
new file mode 100644
index 00000000..d54ecf27
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/common_loglevel.go
@@ -0,0 +1,81 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+// Log level type
+type LogLevel uint8
+
+// Log levels
+const (
+	TraceLvl = iota
+	DebugLvl
+	InfoLvl
+	WarnLvl
+	ErrorLvl
+	CriticalLvl
+	Off
+)
+
+// Log level string representations (used in configuration files)
+const (
+	TraceStr    = "trace"
+	DebugStr    = "debug"
+	InfoStr     = "info"
+	WarnStr     = "warn"
+	ErrorStr    = "error"
+	CriticalStr = "critical"
+	OffStr      = "off"
+)
+
+var levelToStringRepresentations = map[LogLevel]string{
+	TraceLvl:    TraceStr,
+	DebugLvl:    DebugStr,
+	InfoLvl:     InfoStr,
+	WarnLvl:     WarnStr,
+	ErrorLvl:    ErrorStr,
+	CriticalLvl: CriticalStr,
+	Off:         OffStr,
+}
+
+// LogLevelFromString parses a string and returns a corresponding log level, if sucessfull.
+func LogLevelFromString(levelStr string) (level LogLevel, found bool) {
+	for lvl, lvlStr := range levelToStringRepresentations {
+		if lvlStr == levelStr {
+			return lvl, true
+		}
+	}
+
+	return 0, false
+}
+
+// LogLevelToString returns seelog string representation for a specified level. Returns "" for invalid log levels.
+func (level LogLevel) String() string {
+	levelStr, ok := levelToStringRepresentations[level]
+	if ok {
+		return levelStr
+	}
+
+	return ""
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/dispatch_custom.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/dispatch_custom.go
new file mode 100644
index 00000000..383a7705
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/dispatch_custom.go
@@ -0,0 +1,242 @@
+// Copyright (c) 2013 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"errors"
+	"fmt"
+	"reflect"
+	"sort"
+)
+
+var registeredReceivers = make(map[string]reflect.Type)
+
+// RegisterReceiver records a custom receiver type, identified by a value
+// of that type (second argument), under the specified name. Registered
+// names can be used in the "name" attribute of <custom> config items.
+//
+// RegisterReceiver takes the type of the receiver argument, without taking
+// the value into the account. So do NOT enter any data to the second argument
+// and only call it like:
+//     RegisterReceiver("somename", &MyReceiverType{})
+//
+// After that, when a '<custom>' config tag with this name is used,
+// a receiver of the specified type would be instantiated. Check
+// CustomReceiver comments for interface details.
+//
+// NOTE 1: RegisterReceiver fails if you attempt to register different types
+// with the same name.
+//
+// NOTE 2: RegisterReceiver registers those receivers that must be used in
+// the configuration files (<custom> items). Basically it is just the way
+// you tell seelog config parser what should it do when it meets a
+// <custom> tag with a specific name and data attributes.
+//
+// But If you are only using seelog as a proxy to an already instantiated
+// CustomReceiver (via LoggerFromCustomReceiver func), you should not call RegisterReceiver.
+func RegisterReceiver(name string, receiver CustomReceiver) {
+	newType := reflect.TypeOf(reflect.ValueOf(receiver).Elem().Interface())
+	if t, ok := registeredReceivers[name]; ok && t != newType {
+		panic(fmt.Sprintf("duplicate types for %s: %s != %s", name, t, newType))
+	}
+	registeredReceivers[name] = newType
+}
+
+func customReceiverByName(name string) (creceiver CustomReceiver, err error) {
+	rt, ok := registeredReceivers[name]
+	if !ok {
+		return nil, fmt.Errorf("custom receiver name not registered: '%s'", name)
+	}
+	v, ok := reflect.New(rt).Interface().(CustomReceiver)
+	if !ok {
+		return nil, fmt.Errorf("cannot instantiate receiver with name='%s'", name)
+	}
+	return v, nil
+}
+
+// CustomReceiverInitArgs represent arguments passed to the CustomReceiver.Init
+// func when custom receiver is being initialized.
+type CustomReceiverInitArgs struct {
+	// XmlCustomAttrs represent '<custom>' xml config item attributes that
+	// start with "data-". Map keys will be the attribute names without the "data-".
+	// Map values will the those attribute values.
+	//
+	// E.g. if you have a '<custom name="somename" data-attr1="a1" data-attr2="a2"/>'
+	// you will get map with 2 key-value pairs: "attr1"->"a1", "attr2"->"a2"
+	//
+	// Note that in custom items you can only use allowed attributes, like "name" and
+	// your custom attributes, starting with "data-". Any other will lead to a
+	// parsing error.
+	XmlCustomAttrs map[string]string
+}
+
+// CustomReceiver is the interface that external custom seelog message receivers
+// must implement in order to be able to process seelog messages. Those receivers
+// are set in the xml config file using the <custom> tag. Check receivers reference
+// wiki section on that.
+//
+// Use seelog.RegisterReceiver on the receiver type before using it.
+type CustomReceiver interface {
+	// ReceiveMessage is called when the custom receiver gets seelog message from
+	// a parent dispatcher.
+	//
+	// Message, level and context args represent all data that was included in the seelog
+	// message at the time it was logged.
+	//
+	// The formatting is already applied to the message and depends on the config
+	// like with any other receiver.
+	//
+	// If you would like to inform seelog of an error that happened during the handling of
+	// the message, return a non-nil error. This way you'll end up seeing your error like
+	// any other internal seelog error.
+	ReceiveMessage(message string, level LogLevel, context LogContextInterface) error
+
+	// AfterParse is called immediately after your custom receiver is instantiated by
+	// the xml config parser. So, if you need to do any startup logic after config parsing,
+	// like opening file or allocating any resources after the receiver is instantiated, do it here.
+	//
+	// If this func returns a non-nil error, then the loading procedure will fail. E.g.
+	// if you are loading a seelog xml config, the parser would not finish the loading
+	// procedure and inform about an error like with any other config error.
+	//
+	// If your custom logger needs some configuration, you can use custom attributes in
+	// your config. Check CustomReceiverInitArgs.XmlCustomAttrs comments.
+	//
+	// IMPORTANT: This func is NOT called when the LoggerFromCustomReceiver func is used
+	// to create seelog proxy logger using the custom receiver. This func is only called when
+	// receiver is instantiated from a config.
+	AfterParse(initArgs CustomReceiverInitArgs) error
+
+	// Flush is called when the custom receiver gets a 'flush' directive from a
+	// parent receiver. If custom receiver implements some kind of buffering or
+	// queing, then the appropriate reaction on a flush message is synchronous
+	// flushing of all those queues/buffers. If custom receiver doesn't have
+	// such mechanisms, then flush implementation may be left empty.
+	Flush()
+
+	// Close is called when the custom receiver gets a 'close' directive from a
+	// parent receiver. This happens when a top-level seelog dispatcher is sending
+	// 'close' to all child nodes and it means that current seelog logger is being closed.
+	// If you need to do any cleanup after your custom receiver is done, you should do
+	// it here.
+	Close() error
+}
+
+type customReceiverDispatcher struct {
+	formatter          *formatter
+	innerReceiver      CustomReceiver
+	customReceiverName string
+	usedArgs           CustomReceiverInitArgs
+}
+
+// NewCustomReceiverDispatcher creates a customReceiverDispatcher which dispatches data to a specific receiver created
+// using a <custom> tag in the config file.
+func NewCustomReceiverDispatcher(formatter *formatter, customReceiverName string, cArgs CustomReceiverInitArgs) (*customReceiverDispatcher, error) {
+	if formatter == nil {
+		return nil, errors.New("formatter cannot be nil")
+	}
+	if len(customReceiverName) == 0 {
+		return nil, errors.New("custom receiver name cannot be empty")
+	}
+
+	creceiver, err := customReceiverByName(customReceiverName)
+	if err != nil {
+		return nil, err
+	}
+	err = creceiver.AfterParse(cArgs)
+	if err != nil {
+		return nil, err
+	}
+	disp := &customReceiverDispatcher{formatter, creceiver, customReceiverName, cArgs}
+
+	return disp, nil
+}
+
+// NewCustomReceiverDispatcherByValue is basically the same as NewCustomReceiverDispatcher, but using
+// a specific CustomReceiver value instead of instantiating a new one by type.
+func NewCustomReceiverDispatcherByValue(formatter *formatter, customReceiver CustomReceiver, name string, cArgs CustomReceiverInitArgs) (*customReceiverDispatcher, error) {
+	if formatter == nil {
+		return nil, errors.New("formatter cannot be nil")
+	}
+	if customReceiver == nil {
+		return nil, errors.New("customReceiver cannot be nil")
+	}
+	disp := &customReceiverDispatcher{formatter, customReceiver, name, cArgs}
+
+	return disp, nil
+}
+
+// CustomReceiver implementation. Check CustomReceiver comments.
+func (disp *customReceiverDispatcher) Dispatch(
+	message string,
+	level LogLevel,
+	context LogContextInterface,
+	errorFunc func(err error)) {
+
+	defer func() {
+		if err := recover(); err != nil {
+			errorFunc(fmt.Errorf("panic in custom receiver '%s'.Dispatch: %s", reflect.TypeOf(disp.innerReceiver), err))
+		}
+	}()
+
+	err := disp.innerReceiver.ReceiveMessage(disp.formatter.Format(message, level, context), level, context)
+	if err != nil {
+		errorFunc(err)
+	}
+}
+
+// CustomReceiver implementation. Check CustomReceiver comments.
+func (disp *customReceiverDispatcher) Flush() {
+	disp.innerReceiver.Flush()
+}
+
+// CustomReceiver implementation. Check CustomReceiver comments.
+func (disp *customReceiverDispatcher) Close() error {
+	disp.innerReceiver.Flush()
+
+	err := disp.innerReceiver.Close()
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (disp *customReceiverDispatcher) String() string {
+	datas := ""
+	skeys := make([]string, 0, len(disp.usedArgs.XmlCustomAttrs))
+	for i := range disp.usedArgs.XmlCustomAttrs {
+		skeys = append(skeys, i)
+	}
+	sort.Strings(skeys)
+	for _, key := range skeys {
+		datas += fmt.Sprintf("<%s, %s> ", key, disp.usedArgs.XmlCustomAttrs[key])
+	}
+
+	str := fmt.Sprintf("Custom receiver %s [fmt='%s'],[data='%s'],[inner='%s']\n",
+		disp.customReceiverName, disp.formatter.String(), datas, disp.innerReceiver)
+
+	return str
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/dispatch_dispatcher.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/dispatch_dispatcher.go
new file mode 100644
index 00000000..2bd3b4a4
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/dispatch_dispatcher.go
@@ -0,0 +1,189 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"errors"
+	"fmt"
+	"io"
+)
+
+// A dispatcherInterface is used to dispatch message to all underlying receivers.
+// Dispatch logic depends on given context and log level. Any errors are reported using errorFunc.
+// Also, as underlying receivers may have a state, dispatcher has a ShuttingDown method which performs
+// an immediate cleanup of all data that is stored in the receivers
+type dispatcherInterface interface {
+	flusherInterface
+	io.Closer
+	Dispatch(message string, level LogLevel, context LogContextInterface, errorFunc func(err error))
+}
+
+type dispatcher struct {
+	formatter   *formatter
+	writers     []*formattedWriter
+	dispatchers []dispatcherInterface
+}
+
+// Creates a dispatcher which dispatches data to a list of receivers.
+// Each receiver should be either a Dispatcher or io.Writer, otherwise an error will be returned
+func createDispatcher(formatter *formatter, receivers []interface{}) (*dispatcher, error) {
+	if formatter == nil {
+		return nil, errors.New("formatter cannot be nil")
+	}
+	if receivers == nil || len(receivers) == 0 {
+		return nil, errors.New("receivers cannot be nil or empty")
+	}
+
+	disp := &dispatcher{formatter, make([]*formattedWriter, 0), make([]dispatcherInterface, 0)}
+	for _, receiver := range receivers {
+		writer, ok := receiver.(*formattedWriter)
+		if ok {
+			disp.writers = append(disp.writers, writer)
+			continue
+		}
+
+		ioWriter, ok := receiver.(io.Writer)
+		if ok {
+			writer, err := NewFormattedWriter(ioWriter, disp.formatter)
+			if err != nil {
+				return nil, err
+			}
+			disp.writers = append(disp.writers, writer)
+			continue
+		}
+
+		dispInterface, ok := receiver.(dispatcherInterface)
+		if ok {
+			disp.dispatchers = append(disp.dispatchers, dispInterface)
+			continue
+		}
+
+		return nil, errors.New("method can receive either io.Writer or dispatcherInterface")
+	}
+
+	return disp, nil
+}
+
+func (disp *dispatcher) Dispatch(
+	message string,
+	level LogLevel,
+	context LogContextInterface,
+	errorFunc func(err error)) {
+
+	for _, writer := range disp.writers {
+		err := writer.Write(message, level, context)
+		if err != nil {
+			errorFunc(err)
+		}
+	}
+
+	for _, dispInterface := range disp.dispatchers {
+		dispInterface.Dispatch(message, level, context, errorFunc)
+	}
+}
+
+// Flush goes through all underlying writers which implement flusherInterface interface
+// and closes them. Recursively performs the same action for underlying dispatchers
+func (disp *dispatcher) Flush() {
+	for _, disp := range disp.Dispatchers() {
+		disp.Flush()
+	}
+
+	for _, formatWriter := range disp.Writers() {
+		flusher, ok := formatWriter.Writer().(flusherInterface)
+		if ok {
+			flusher.Flush()
+		}
+	}
+}
+
+// Close goes through all underlying writers which implement io.Closer interface
+// and closes them. Recursively performs the same action for underlying dispatchers
+// Before closing, writers are flushed to prevent loss of any buffered data, so
+// a call to Flush() func before Close() is not necessary
+func (disp *dispatcher) Close() error {
+	for _, disp := range disp.Dispatchers() {
+		disp.Flush()
+		err := disp.Close()
+		if err != nil {
+			return err
+		}
+	}
+
+	for _, formatWriter := range disp.Writers() {
+		flusher, ok := formatWriter.Writer().(flusherInterface)
+		if ok {
+			flusher.Flush()
+		}
+
+		closer, ok := formatWriter.Writer().(io.Closer)
+		if ok {
+			err := closer.Close()
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func (disp *dispatcher) Writers() []*formattedWriter {
+	return disp.writers
+}
+
+func (disp *dispatcher) Dispatchers() []dispatcherInterface {
+	return disp.dispatchers
+}
+
+func (disp *dispatcher) String() string {
+	str := "formatter: " + disp.formatter.String() + "\n"
+
+	str += "    ->Dispatchers:"
+
+	if len(disp.dispatchers) == 0 {
+		str += "none\n"
+	} else {
+		str += "\n"
+
+		for _, disp := range disp.dispatchers {
+			str += fmt.Sprintf("        ->%s", disp)
+		}
+	}
+
+	str += "    ->Writers:"
+
+	if len(disp.writers) == 0 {
+		str += "none\n"
+	} else {
+		str += "\n"
+
+		for _, writer := range disp.writers {
+			str += fmt.Sprintf("        ->%s\n", writer)
+		}
+	}
+
+	return str
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/dispatch_filterdispatcher.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/dispatch_filterdispatcher.go
new file mode 100644
index 00000000..9de8a722
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/dispatch_filterdispatcher.go
@@ -0,0 +1,66 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"fmt"
+)
+
+// A filterDispatcher writes the given message to underlying receivers only if message log level
+// is in the allowed list.
+type filterDispatcher struct {
+	*dispatcher
+	allowList map[LogLevel]bool
+}
+
+// NewFilterDispatcher creates a new filterDispatcher using a list of allowed levels.
+func NewFilterDispatcher(formatter *formatter, receivers []interface{}, allowList ...LogLevel) (*filterDispatcher, error) {
+	disp, err := createDispatcher(formatter, receivers)
+	if err != nil {
+		return nil, err
+	}
+
+	allows := make(map[LogLevel]bool)
+	for _, allowLevel := range allowList {
+		allows[allowLevel] = true
+	}
+
+	return &filterDispatcher{disp, allows}, nil
+}
+
+func (filter *filterDispatcher) Dispatch(
+	message string,
+	level LogLevel,
+	context LogContextInterface,
+	errorFunc func(err error)) {
+	isAllowed, ok := filter.allowList[level]
+	if ok && isAllowed {
+		filter.dispatcher.Dispatch(message, level, context, errorFunc)
+	}
+}
+
+func (filter *filterDispatcher) String() string {
+	return fmt.Sprintf("filterDispatcher ->\n%s", filter.dispatcher)
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/dispatch_splitdispatcher.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/dispatch_splitdispatcher.go
new file mode 100644
index 00000000..1d0fe7ea
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/dispatch_splitdispatcher.go
@@ -0,0 +1,47 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"fmt"
+)
+
+// A splitDispatcher just writes the given message to underlying receivers. (Splits the message stream.)
+type splitDispatcher struct {
+	*dispatcher
+}
+
+func NewSplitDispatcher(formatter *formatter, receivers []interface{}) (*splitDispatcher, error) {
+	disp, err := createDispatcher(formatter, receivers)
+	if err != nil {
+		return nil, err
+	}
+
+	return &splitDispatcher{disp}, nil
+}
+
+func (splitter *splitDispatcher) String() string {
+	return fmt.Sprintf("splitDispatcher ->\n%s", splitter.dispatcher.String())
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/doc.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/doc.go
new file mode 100644
index 00000000..2734c9cb
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/doc.go
@@ -0,0 +1,175 @@
+// Copyright (c) 2014 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+/*
+Package seelog implements logging functionality with flexible dispatching, filtering, and formatting.
+
+Creation
+
+To create a logger, use one of the following constructors:
+  func LoggerFromConfigAsBytes
+  func LoggerFromConfigAsFile
+  func LoggerFromConfigAsString
+  func LoggerFromWriterWithMinLevel
+  func LoggerFromWriterWithMinLevelAndFormat
+  func LoggerFromCustomReceiver (check https://github.com/cihub/seelog/wiki/Custom-receivers)
+Example:
+  import log "github.com/cihub/seelog"
+
+  func main() {
+      logger, err := log.LoggerFromConfigAsFile("seelog.xml")
+      if err != nil {
+          panic(err)
+      }
+      defer logger.Flush()
+      ... use logger ...
+  }
+The "defer" line is important because if you are using asynchronous logger behavior, without this line you may end up losing some
+messages when you close your application because they are processed in another non-blocking goroutine. To avoid that you
+explicitly defer flushing all messages before closing.
+
+Usage
+
+Logger created using one of the LoggerFrom* funcs can be used directly by calling one of the main log funcs.
+Example:
+  import log "github.com/cihub/seelog"
+
+  func main() {
+      logger, err := log.LoggerFromConfigAsFile("seelog.xml")
+      if err != nil {
+          panic(err)
+      }
+      defer logger.Flush()
+      logger.Trace("test")
+      logger.Debugf("var = %s", "abc")
+  }
+
+Having loggers as variables is convenient if you are writing your own package with internal logging or if you have
+several loggers with different options.
+But for most standalone apps it is more convenient to use package level funcs and vars. There is a package level
+var 'Current' made for it. You can replace it with another logger using 'ReplaceLogger' and then use package level funcs:
+  import log "github.com/cihub/seelog"
+
+  func main() {
+      logger, err := log.LoggerFromConfigAsFile("seelog.xml")
+      if err != nil {
+          panic(err)
+      }
+      log.ReplaceLogger(logger)
+      defer log.Flush()
+      log.Trace("test")
+      log.Debugf("var = %s", "abc")
+  }
+Last lines
+      log.Trace("test")
+      log.Debugf("var = %s", "abc")
+do the same as
+      log.Current.Trace("test")
+      log.Current.Debugf("var = %s", "abc")
+In this example the 'Current' logger was replaced using a 'ReplaceLogger' call and became equal to 'logger' variable created from config.
+This way you are able to use package level funcs instead of passing the logger variable.
+
+Configuration
+
+Main seelog point is to configure logger via config files and not the code.
+The configuration is read by LoggerFrom* funcs. These funcs read xml configuration from different sources and try
+to create a logger using it.
+
+All the configuration features are covered in detail in the official wiki: https://github.com/cihub/seelog/wiki.
+There are many sections covering different aspects of seelog, but the most important for understanding configs are:
+    https://github.com/cihub/seelog/wiki/Constraints-and-exceptions
+    https://github.com/cihub/seelog/wiki/Dispatchers-and-receivers
+    https://github.com/cihub/seelog/wiki/Formatting
+    https://github.com/cihub/seelog/wiki/Logger-types
+After you understand these concepts, check the 'Reference' section on the main wiki page to get the up-to-date
+list of dispatchers, receivers, formats, and logger types.
+
+Here is an example config with all these features:
+    <seelog type="adaptive" mininterval="2000000" maxinterval="100000000" critmsgcount="500" minlevel="debug">
+        <exceptions>
+            <exception filepattern="test*" minlevel="error"/>
+        </exceptions>
+        <outputs formatid="all">
+            <file path="all.log"/>
+            <filter levels="info">
+              <console formatid="fmtinfo"/>
+            </filter>
+            <filter levels="error,critical" formatid="fmterror">
+              <console/>
+              <file path="errors.log"/>
+            </filter>
+        </outputs>
+        <formats>
+            <format id="fmtinfo" format="[%Level] [%Time] %Msg%n"/>
+            <format id="fmterror" format="[%LEVEL] [%Time] [%FuncShort @ %File.%Line] %Msg%n"/>
+            <format id="all" format="[%Level] [%Time] [@ %File.%Line] %Msg%n"/>
+            <format id="criticalemail" format="Critical error on our server!\n    %Time %Date %RelFile %Func %Msg \nSent by Seelog"/>
+        </formats>
+    </seelog>
+This config represents a logger with adaptive timeout between log messages (check logger types reference) which
+logs to console, all.log, and errors.log depending on the log level. Its output formats also depend on log level. This logger will only
+use log level 'debug' and higher (minlevel is set) for all files with names that don't start with 'test'. For files starting with 'test'
+this logger prohibits all levels below 'error'.
+
+Configuration using code
+
+Although configuration using code is not recommended, it is sometimes needed and it is possible to do with seelog. Basically, what
+you need to do to get started is to create constraints, exceptions and a dispatcher tree (same as with config). Most of the New*
+functions in this package are used to provide such capabilities.
+
+Here is an example of configuration in code, that demonstrates an async loop logger that logs to a simple split dispatcher with
+a console receiver using a specified format and is filtered using a top-level min-max constraints and one expection for
+the 'main.go' file. So, this is basically a demonstration of configuration of most of the features:
+
+  package main
+
+  import log "github.com/cihub/seelog"
+
+  func main() {
+      defer log.Flush()
+      log.Info("Hello from Seelog!")
+
+      consoleWriter, _ := log.NewConsoleWriter()
+      formatter, _ := log.NewFormatter("%Level %Msg %File%n")
+      root, _ := log.NewSplitDispatcher(formatter, []interface{}{consoleWriter})
+      constraints, _ := log.NewMinMaxConstraints(log.TraceLvl, log.CriticalLvl)
+      specificConstraints, _ := log.NewListConstraints([]log.LogLevel{log.InfoLvl, log.ErrorLvl})
+      ex, _ := log.NewLogLevelException("*", "*main.go", specificConstraints)
+      exceptions := []*log.LogLevelException{ex}
+
+      logger := log.NewAsyncLoopLogger(log.NewLoggerConfig(constraints, exceptions, root))
+      log.ReplaceLogger(logger)
+
+      log.Trace("This should not be seen")
+      log.Debug("This should not be seen")
+      log.Info("Test")
+      log.Error("Test2")
+  }
+
+Examples
+
+To learn seelog features faster you should check the examples package: https://github.com/cihub/seelog-examples
+It contains many example configs and usecases.
+*/
+package seelog
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/format.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/format.go
new file mode 100644
index 00000000..32682f34
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/format.go
@@ -0,0 +1,461 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+	"unicode"
+	"unicode/utf8"
+)
+
+// FormatterSymbol is a special symbol used in config files to mark special format aliases.
+const (
+	FormatterSymbol = '%'
+)
+
+const (
+	formatterParameterStart = '('
+	formatterParameterEnd   = ')'
+)
+
+// Time and date formats used for %Date and %Time aliases.
+const (
+	DateDefaultFormat = "2006-01-02"
+	TimeFormat        = "15:04:05"
+)
+
+var DefaultMsgFormat = "%Ns [%Level] %Msg%n"
+
+var (
+	DefaultFormatter *formatter
+	msgonlyformatter *formatter
+)
+
+func init() {
+	var err error
+	if DefaultFormatter, err = NewFormatter(DefaultMsgFormat); err != nil {
+		reportInternalError(fmt.Errorf("error during creating DefaultFormatter: %s", err))
+	}
+	if msgonlyformatter, err = NewFormatter("%Msg"); err != nil {
+		reportInternalError(fmt.Errorf("error during creating msgonlyformatter: %s", err))
+	}
+}
+
+// FormatterFunc represents one formatter object that starts with '%' sign in the 'format' attribute
+// of the 'format' config item. These special symbols are replaced with context values or special
+// strings when message is written to byte receiver.
+//
+// Check https://github.com/cihub/seelog/wiki/Formatting for details.
+// Full list (with descriptions) of formatters: https://github.com/cihub/seelog/wiki/Format-reference
+//
+// FormatterFunc takes raw log message, level, log context and returns a string, number (of any type) or any object
+// that can be evaluated as string.
+type FormatterFunc func(message string, level LogLevel, context LogContextInterface) interface{}
+
+// FormatterFuncCreator is a factory of FormatterFunc objects. It is used to generate parameterized
+// formatters (such as %Date or %EscM) and custom user formatters.
+type FormatterFuncCreator func(param string) FormatterFunc
+
+var formatterFuncs = map[string]FormatterFunc{
+	"Level":     formatterLevel,
+	"Lev":       formatterLev,
+	"LEVEL":     formatterLEVEL,
+	"LEV":       formatterLEV,
+	"l":         formatterl,
+	"Msg":       formatterMsg,
+	"FullPath":  formatterFullPath,
+	"File":      formatterFile,
+	"RelFile":   formatterRelFile,
+	"Func":      FormatterFunction,
+	"FuncShort": FormatterFunctionShort,
+	"Line":      formatterLine,
+	"Time":      formatterTime,
+	"UTCTime":   formatterUTCTime,
+	"Ns":        formatterNs,
+	"UTCNs":     formatterUTCNs,
+	"n":         formattern,
+	"t":         formattert,
+}
+
+var formatterFuncsParameterized = map[string]FormatterFuncCreator{
+	"Date":    createDateTimeFormatterFunc,
+	"UTCDate": createUTCDateTimeFormatterFunc,
+	"EscM":    createANSIEscapeFunc,
+}
+
+func errorAliasReserved(name string) error {
+	return fmt.Errorf("cannot use '%s' as custom formatter name. Name is reserved", name)
+}
+
+// RegisterCustomFormatter registers a new custom formatter factory with a given name. If returned error is nil,
+// then this name (prepended by '%' symbol) can be used in 'format' attributes in configuration and
+// it will be treated like the standard parameterized formatter identifiers.
+//
+// RegisterCustomFormatter needs to be called before creating a logger for it to take effect. The general recommendation
+// is to call it once in 'init' func of your application or any initializer func.
+//
+// For usage examples, check https://github.com/cihub/seelog/wiki/Custom-formatters.
+//
+// Name must only consist of letters (unicode.IsLetter).
+//
+// Name must not be one of the already registered standard formatter names
+// (https://github.com/cihub/seelog/wiki/Format-reference) and previously registered
+// custom format names. To avoid any potential name conflicts (in future releases), it is recommended
+// to start your custom formatter name with a namespace (e.g. 'MyCompanySomething') or a 'Custom' keyword.
+func RegisterCustomFormatter(name string, creator FormatterFuncCreator) error {
+	if _, ok := formatterFuncs[name]; ok {
+		return errorAliasReserved(name)
+	}
+	if _, ok := formatterFuncsParameterized[name]; ok {
+		return errorAliasReserved(name)
+	}
+	formatterFuncsParameterized[name] = creator
+	return nil
+}
+
+// formatter is used to write messages in a specific format, inserting such additional data
+// as log level, date/time, etc.
+type formatter struct {
+	fmtStringOriginal string
+	fmtString         string
+	formatterFuncs    []FormatterFunc
+}
+
+// NewFormatter creates a new formatter using a format string
+func NewFormatter(formatString string) (*formatter, error) {
+	fmtr := new(formatter)
+	fmtr.fmtStringOriginal = formatString
+	if err := buildFormatterFuncs(fmtr); err != nil {
+		return nil, err
+	}
+	return fmtr, nil
+}
+
+func buildFormatterFuncs(formatter *formatter) error {
+	var (
+		fsbuf  = new(bytes.Buffer)
+		fsolm1 = len(formatter.fmtStringOriginal) - 1
+	)
+	for i := 0; i <= fsolm1; i++ {
+		if char := formatter.fmtStringOriginal[i]; char != FormatterSymbol {
+			fsbuf.WriteByte(char)
+			continue
+		}
+		// Check if the index is at the end of the string.
+		if i == fsolm1 {
+			return fmt.Errorf("format error: %c cannot be last symbol", FormatterSymbol)
+		}
+		// Check if the formatter symbol is doubled and skip it as nonmatching.
+		if formatter.fmtStringOriginal[i+1] == FormatterSymbol {
+			fsbuf.WriteRune(FormatterSymbol)
+			i++
+			continue
+		}
+		function, ni, err := formatter.extractFormatterFunc(i + 1)
+		if err != nil {
+			return err
+		}
+		// Append formatting string "%v".
+		fsbuf.Write([]byte{37, 118})
+		i = ni
+		formatter.formatterFuncs = append(formatter.formatterFuncs, function)
+	}
+	formatter.fmtString = fsbuf.String()
+	return nil
+}
+
+func (formatter *formatter) extractFormatterFunc(index int) (FormatterFunc, int, error) {
+	letterSequence := formatter.extractLetterSequence(index)
+	if len(letterSequence) == 0 {
+		return nil, 0, fmt.Errorf("format error: lack of formatter after %c at %d", FormatterSymbol, index)
+	}
+
+	function, formatterLength, ok := formatter.findFormatterFunc(letterSequence)
+	if ok {
+		return function, index + formatterLength - 1, nil
+	}
+
+	function, formatterLength, ok, err := formatter.findFormatterFuncParametrized(letterSequence, index)
+	if err != nil {
+		return nil, 0, err
+	}
+	if ok {
+		return function, index + formatterLength - 1, nil
+	}
+
+	return nil, 0, errors.New("format error: unrecognized formatter at " + strconv.Itoa(index) + ": " + letterSequence)
+}
+
+func (formatter *formatter) extractLetterSequence(index int) string {
+	letters := ""
+
+	bytesToParse := []byte(formatter.fmtStringOriginal[index:])
+	runeCount := utf8.RuneCount(bytesToParse)
+	for i := 0; i < runeCount; i++ {
+		rune, runeSize := utf8.DecodeRune(bytesToParse)
+		bytesToParse = bytesToParse[runeSize:]
+
+		if unicode.IsLetter(rune) {
+			letters += string(rune)
+		} else {
+			break
+		}
+	}
+	return letters
+}
+
+func (formatter *formatter) findFormatterFunc(letters string) (FormatterFunc, int, bool) {
+	currentVerb := letters
+	for i := 0; i < len(letters); i++ {
+		function, ok := formatterFuncs[currentVerb]
+		if ok {
+			return function, len(currentVerb), ok
+		}
+		currentVerb = currentVerb[:len(currentVerb)-1]
+	}
+
+	return nil, 0, false
+}
+
+func (formatter *formatter) findFormatterFuncParametrized(letters string, lettersStartIndex int) (FormatterFunc, int, bool, error) {
+	currentVerb := letters
+	for i := 0; i < len(letters); i++ {
+		functionCreator, ok := formatterFuncsParameterized[currentVerb]
+		if ok {
+			parameter := ""
+			parameterLen := 0
+			isVerbEqualsLetters := i == 0 // if not, then letter goes after formatter, and formatter is parameterless
+			if isVerbEqualsLetters {
+				userParameter := ""
+				var err error
+				userParameter, parameterLen, ok, err = formatter.findparameter(lettersStartIndex + len(currentVerb))
+				if ok {
+					parameter = userParameter
+				} else if err != nil {
+					return nil, 0, false, err
+				}
+			}
+
+			return functionCreator(parameter), len(currentVerb) + parameterLen, true, nil
+		}
+
+		currentVerb = currentVerb[:len(currentVerb)-1]
+	}
+
+	return nil, 0, false, nil
+}
+
+func (formatter *formatter) findparameter(startIndex int) (string, int, bool, error) {
+	if len(formatter.fmtStringOriginal) == startIndex || formatter.fmtStringOriginal[startIndex] != formatterParameterStart {
+		return "", 0, false, nil
+	}
+
+	endIndex := strings.Index(formatter.fmtStringOriginal[startIndex:], string(formatterParameterEnd))
+	if endIndex == -1 {
+		return "", 0, false, fmt.Errorf("Unmatched parenthesis or invalid parameter at %d: %s",
+			startIndex, formatter.fmtStringOriginal[startIndex:])
+	}
+	endIndex += startIndex
+
+	length := endIndex - startIndex + 1
+
+	return formatter.fmtStringOriginal[startIndex+1 : endIndex], length, true, nil
+}
+
+// Format processes a message with special formatters, log level, and context. Returns formatted string
+// with all formatter identifiers changed to appropriate values.
+func (formatter *formatter) Format(message string, level LogLevel, context LogContextInterface) string {
+	if len(formatter.formatterFuncs) == 0 {
+		return formatter.fmtString
+	}
+
+	params := make([]interface{}, len(formatter.formatterFuncs))
+	for i, function := range formatter.formatterFuncs {
+		params[i] = function(message, level, context)
+	}
+
+	return fmt.Sprintf(formatter.fmtString, params...)
+}
+
+func (formatter *formatter) String() string {
+	return formatter.fmtStringOriginal
+}
+
+//=====================================================
+
+const (
+	wrongLogLevel   = "WRONG_LOGLEVEL"
+	wrongEscapeCode = "WRONG_ESCAPE"
+)
+
+var levelToString = map[LogLevel]string{
+	TraceLvl:    "Trace",
+	DebugLvl:    "Debug",
+	InfoLvl:     "Info",
+	WarnLvl:     "Warn",
+	ErrorLvl:    "Error",
+	CriticalLvl: "Critical",
+	Off:         "Off",
+}
+
+var levelToShortString = map[LogLevel]string{
+	TraceLvl:    "Trc",
+	DebugLvl:    "Dbg",
+	InfoLvl:     "Inf",
+	WarnLvl:     "Wrn",
+	ErrorLvl:    "Err",
+	CriticalLvl: "Crt",
+	Off:         "Off",
+}
+
+var levelToShortestString = map[LogLevel]string{
+	TraceLvl:    "t",
+	DebugLvl:    "d",
+	InfoLvl:     "i",
+	WarnLvl:     "w",
+	ErrorLvl:    "e",
+	CriticalLvl: "c",
+	Off:         "o",
+}
+
+func formatterLevel(message string, level LogLevel, context LogContextInterface) interface{} {
+	levelStr, ok := levelToString[level]
+	if !ok {
+		return wrongLogLevel
+	}
+	return levelStr
+}
+
+func formatterLev(message string, level LogLevel, context LogContextInterface) interface{} {
+	levelStr, ok := levelToShortString[level]
+	if !ok {
+		return wrongLogLevel
+	}
+	return levelStr
+}
+
+func formatterLEVEL(message string, level LogLevel, context LogContextInterface) interface{} {
+	return strings.ToTitle(formatterLevel(message, level, context).(string))
+}
+
+func formatterLEV(message string, level LogLevel, context LogContextInterface) interface{} {
+	return strings.ToTitle(formatterLev(message, level, context).(string))
+}
+
+func formatterl(message string, level LogLevel, context LogContextInterface) interface{} {
+	levelStr, ok := levelToShortestString[level]
+	if !ok {
+		return wrongLogLevel
+	}
+	return levelStr
+}
+
+func formatterMsg(message string, level LogLevel, context LogContextInterface) interface{} {
+	return message
+}
+
+func formatterFullPath(message string, level LogLevel, context LogContextInterface) interface{} {
+	return context.FullPath()
+}
+
+func formatterFile(message string, level LogLevel, context LogContextInterface) interface{} {
+	return context.FileName()
+}
+
+func formatterRelFile(message string, level LogLevel, context LogContextInterface) interface{} {
+	return context.ShortPath()
+}
+
+func FormatterFunction(message string, level LogLevel, context LogContextInterface) interface{} {
+	return context.Func()
+}
+
+func FormatterFunctionShort(message string, level LogLevel, context LogContextInterface) interface{} {
+	f := context.Func()
+	spl := strings.Split(f, ".")
+	return spl[len(spl)-1]
+}
+
+func formatterLine(message string, level LogLevel, context LogContextInterface) interface{} {
+	return context.Line()
+}
+
+func formatterTime(message string, level LogLevel, context LogContextInterface) interface{} {
+	return context.CallTime().Format(TimeFormat)
+}
+
+func formatterUTCTime(message string, level LogLevel, context LogContextInterface) interface{} {
+	return context.CallTime().UTC().Format(TimeFormat)
+}
+
+func formatterNs(message string, level LogLevel, context LogContextInterface) interface{} {
+	return context.CallTime().UnixNano()
+}
+
+func formatterUTCNs(message string, level LogLevel, context LogContextInterface) interface{} {
+	return context.CallTime().UTC().UnixNano()
+}
+
+func formattern(message string, level LogLevel, context LogContextInterface) interface{} {
+	return "\n"
+}
+
+func formattert(message string, level LogLevel, context LogContextInterface) interface{} {
+	return "\t"
+}
+
+func createDateTimeFormatterFunc(dateTimeFormat string) FormatterFunc {
+	format := dateTimeFormat
+	if format == "" {
+		format = DateDefaultFormat
+	}
+	return func(message string, level LogLevel, context LogContextInterface) interface{} {
+		return context.CallTime().Format(format)
+	}
+}
+
+func createUTCDateTimeFormatterFunc(dateTimeFormat string) FormatterFunc {
+	format := dateTimeFormat
+	if format == "" {
+		format = DateDefaultFormat
+	}
+	return func(message string, level LogLevel, context LogContextInterface) interface{} {
+		return context.CallTime().UTC().Format(format)
+	}
+}
+
+func createANSIEscapeFunc(escapeCodeString string) FormatterFunc {
+	return func(message string, level LogLevel, context LogContextInterface) interface{} {
+		if len(escapeCodeString) == 0 {
+			return wrongEscapeCode
+		}
+
+		return fmt.Sprintf("%c[%sm", 0x1B, escapeCodeString)
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/internals_baseerror.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/internals_baseerror.go
new file mode 100644
index 00000000..c0b271d7
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/internals_baseerror.go
@@ -0,0 +1,10 @@
+package seelog
+
+// Base struct for custom errors.
+type baseError struct {
+	message string
+}
+
+func (be baseError) Error() string {
+	return be.message
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/internals_fsutils.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/internals_fsutils.go
new file mode 100644
index 00000000..5baa6ba6
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/internals_fsutils.go
@@ -0,0 +1,403 @@
+package seelog
+
+import (
+	"archive/zip"
+	"bytes"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"sync"
+)
+
+// File and directory permitions.
+const (
+	defaultFilePermissions      = 0666
+	defaultDirectoryPermissions = 0767
+)
+
+const (
+	// Max number of directories can be read asynchronously.
+	maxDirNumberReadAsync = 1000
+)
+
+type cannotOpenFileError struct {
+	baseError
+}
+
+func newCannotOpenFileError(fname string) *cannotOpenFileError {
+	return &cannotOpenFileError{baseError{message: "Cannot open file: " + fname}}
+}
+
+type notDirectoryError struct {
+	baseError
+}
+
+func newNotDirectoryError(dname string) *notDirectoryError {
+	return &notDirectoryError{baseError{message: dname + " is not directory"}}
+}
+
+// fileFilter is a filtering criteria function for '*os.File'.
+// Must return 'false' to set aside the given file.
+type fileFilter func(os.FileInfo, *os.File) bool
+
+// filePathFilter is a filtering creteria function for file path.
+// Must return 'false' to set aside the given file.
+type filePathFilter func(filePath string) bool
+
+// GetSubdirNames returns a list of directories found in
+// the given one with dirPath.
+func getSubdirNames(dirPath string) ([]string, error) {
+	fi, err := os.Stat(dirPath)
+	if err != nil {
+		return nil, err
+	}
+	if !fi.IsDir() {
+		return nil, newNotDirectoryError(dirPath)
+	}
+	dd, err := os.Open(dirPath)
+	// Cannot open file.
+	if err != nil {
+		if dd != nil {
+			dd.Close()
+		}
+		return nil, err
+	}
+	defer dd.Close()
+	// TODO: Improve performance by buffering reading.
+	allEntities, err := dd.Readdir(-1)
+	if err != nil {
+		return nil, err
+	}
+	subDirs := []string{}
+	for _, entity := range allEntities {
+		if entity.IsDir() {
+			subDirs = append(subDirs, entity.Name())
+		}
+	}
+	return subDirs, nil
+}
+
+// getSubdirAbsPaths recursively visit all the subdirectories
+// starting from the given directory and returns absolute paths for them.
+func getAllSubdirAbsPaths(dirPath string) (res []string, err error) {
+	dps, err := getSubdirAbsPaths(dirPath)
+	if err != nil {
+		res = []string{}
+		return
+	}
+	res = append(res, dps...)
+	for _, dp := range dps {
+		sdps, err := getAllSubdirAbsPaths(dp)
+		if err != nil {
+			return []string{}, err
+		}
+		res = append(res, sdps...)
+	}
+	return
+}
+
+// getSubdirAbsPaths supplies absolute paths for all subdirectiries in a given directory.
+// Input: (I1) dirPath - absolute path of a directory in question.
+// Out: (O1) - slice of subdir asbolute paths; (O2) - error of the operation.
+// Remark: If error (O2) is non-nil then (O1) is nil and vice versa.
+func getSubdirAbsPaths(dirPath string) ([]string, error) {
+	sdns, err := getSubdirNames(dirPath)
+	if err != nil {
+		return nil, err
+	}
+	rsdns := []string{}
+	for _, sdn := range sdns {
+		rsdns = append(rsdns, filepath.Join(dirPath, sdn))
+	}
+	return rsdns, nil
+}
+
+// getOpenFilesInDir supplies a slice of os.File pointers to files located in the directory.
+// Remark: Ignores files for which fileFilter returns false
+func getOpenFilesInDir(dirPath string, fFilter fileFilter) ([]*os.File, error) {
+	dfi, err := os.Open(dirPath)
+	if err != nil {
+		return nil, newCannotOpenFileError("Cannot open directory " + dirPath)
+	}
+	defer dfi.Close()
+	// Size of read buffer (i.e. chunk of items read at a time).
+	rbs := 64
+	resFiles := []*os.File{}
+L:
+	for {
+		// Read directory entities by reasonable chuncks
+		// to prevent overflows on big number of files.
+		fis, e := dfi.Readdir(rbs)
+		switch e {
+		// It's OK.
+		case nil:
+		// Do nothing, just continue cycle.
+		case io.EOF:
+			break L
+		// Something went wrong.
+		default:
+			return nil, e
+		}
+		// THINK: Maybe, use async running.
+		for _, fi := range fis {
+			// NB: On Linux this could be a problem as
+			// there are lots of file types available.
+			if !fi.IsDir() {
+				f, e := os.Open(filepath.Join(dirPath, fi.Name()))
+				if e != nil {
+					if f != nil {
+						f.Close()
+					}
+					// THINK: Add nil as indicator that a problem occurred.
+					resFiles = append(resFiles, nil)
+					continue
+				}
+				// Check filter condition.
+				if fFilter != nil && !fFilter(fi, f) {
+					continue
+				}
+				resFiles = append(resFiles, f)
+			}
+		}
+	}
+	return resFiles, nil
+}
+
+func isRegular(m os.FileMode) bool {
+	return m&os.ModeType == 0
+}
+
+// getDirFilePaths return full paths of the files located in the directory.
+// Remark: Ignores files for which fileFilter returns false.
+func getDirFilePaths(dirPath string, fpFilter filePathFilter, pathIsName bool) ([]string, error) {
+	dfi, err := os.Open(dirPath)
+	if err != nil {
+		return nil, newCannotOpenFileError("Cannot open directory " + dirPath)
+	}
+	defer dfi.Close()
+
+	var absDirPath string
+	if !filepath.IsAbs(dirPath) {
+		absDirPath, err = filepath.Abs(dirPath)
+		if err != nil {
+			return nil, fmt.Errorf("cannot get absolute path of directory: %s", err.Error())
+		}
+	} else {
+		absDirPath = dirPath
+	}
+
+	// TODO: check if dirPath is really directory.
+	// Size of read buffer (i.e. chunk of items read at a time).
+	rbs := 2 << 5
+	filePaths := []string{}
+
+	var fp string
+L:
+	for {
+		// Read directory entities by reasonable chuncks
+		// to prevent overflows on big number of files.
+		fis, e := dfi.Readdir(rbs)
+		switch e {
+		// It's OK.
+		case nil:
+		// Do nothing, just continue cycle.
+		case io.EOF:
+			break L
+		// Indicate that something went wrong.
+		default:
+			return nil, e
+		}
+		// THINK: Maybe, use async running.
+		for _, fi := range fis {
+			// NB: Should work on every Windows and non-Windows OS.
+			if isRegular(fi.Mode()) {
+				if pathIsName {
+					fp = fi.Name()
+				} else {
+					// Build full path of a file.
+					fp = filepath.Join(absDirPath, fi.Name())
+				}
+				// Check filter condition.
+				if fpFilter != nil && !fpFilter(fp) {
+					continue
+				}
+				filePaths = append(filePaths, fp)
+			}
+		}
+	}
+	return filePaths, nil
+}
+
+// getOpenFilesByDirectoryAsync runs async reading directories 'dirPaths' and inserts pairs
+// in map 'filesInDirMap': Key - directory name, value - *os.File slice.
+func getOpenFilesByDirectoryAsync(
+	dirPaths []string,
+	fFilter fileFilter,
+	filesInDirMap map[string][]*os.File,
+) error {
+	n := len(dirPaths)
+	if n > maxDirNumberReadAsync {
+		return fmt.Errorf("number of input directories to be read exceeded max value %d", maxDirNumberReadAsync)
+	}
+	type filesInDirResult struct {
+		DirName string
+		Files   []*os.File
+		Error   error
+	}
+	dirFilesChan := make(chan *filesInDirResult, n)
+	var wg sync.WaitGroup
+	// Register n goroutines which are going to do work.
+	wg.Add(n)
+	for i := 0; i < n; i++ {
+		// Launch asynchronously the piece of work.
+		go func(dirPath string) {
+			fs, e := getOpenFilesInDir(dirPath, fFilter)
+			dirFilesChan <- &filesInDirResult{filepath.Base(dirPath), fs, e}
+			// Mark the current goroutine as finished (work is done).
+			wg.Done()
+		}(dirPaths[i])
+	}
+	// Wait for all goroutines to finish their work.
+	wg.Wait()
+	// Close the error channel to let for-range clause
+	// get all the buffered values without blocking and quit in the end.
+	close(dirFilesChan)
+	for fidr := range dirFilesChan {
+		if fidr.Error == nil {
+			// THINK: What will happen if the key is already present?
+			filesInDirMap[fidr.DirName] = fidr.Files
+		} else {
+			return fidr.Error
+		}
+	}
+	return nil
+}
+
+func copyFile(sf *os.File, dst string) (int64, error) {
+	df, err := os.Create(dst)
+	if err != nil {
+		return 0, err
+	}
+	defer df.Close()
+	return io.Copy(df, sf)
+}
+
+// fileExists return flag whether a given file exists
+// and operation error if an unclassified failure occurs.
+func fileExists(path string) (bool, error) {
+	_, err := os.Stat(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return false, nil
+		}
+		return false, err
+	}
+	return true, nil
+}
+
+// createDirectory makes directory with a given name
+// making all parent directories if necessary.
+func createDirectory(dirPath string) error {
+	var dPath string
+	var err error
+	if !filepath.IsAbs(dirPath) {
+		dPath, err = filepath.Abs(dirPath)
+		if err != nil {
+			return err
+		}
+	} else {
+		dPath = dirPath
+	}
+	exists, err := fileExists(dPath)
+	if err != nil {
+		return err
+	}
+	if exists {
+		return nil
+	}
+	return os.MkdirAll(dPath, os.ModeDir)
+}
+
+// tryRemoveFile gives a try removing the file
+// only ignoring an error when the file does not exist.
+func tryRemoveFile(filePath string) (err error) {
+	err = os.Remove(filePath)
+	if os.IsNotExist(err) {
+		err = nil
+		return
+	}
+	return
+}
+
+// Unzips a specified zip file. Returns filename->filebytes map.
+func unzip(archiveName string) (map[string][]byte, error) {
+	// Open a zip archive for reading.
+	r, err := zip.OpenReader(archiveName)
+	if err != nil {
+		return nil, err
+	}
+	defer r.Close()
+
+	// Files to be added to archive
+	// map file name to contents
+	files := make(map[string][]byte)
+
+	// Iterate through the files in the archive,
+	// printing some of their contents.
+	for _, f := range r.File {
+		rc, err := f.Open()
+		if err != nil {
+			return nil, err
+		}
+
+		bts, err := ioutil.ReadAll(rc)
+		rcErr := rc.Close()
+
+		if err != nil {
+			return nil, err
+		}
+		if rcErr != nil {
+			return nil, rcErr
+		}
+
+		files[f.Name] = bts
+	}
+
+	return files, nil
+}
+
+// Creates a zip file with the specified file names and byte contents.
+func createZip(archiveName string, files map[string][]byte) error {
+	// Create a buffer to write our archive to.
+	buf := new(bytes.Buffer)
+
+	// Create a new zip archive.
+	w := zip.NewWriter(buf)
+
+	// Write files
+	for fpath, fcont := range files {
+		f, err := w.Create(fpath)
+		if err != nil {
+			return err
+		}
+		_, err = f.Write([]byte(fcont))
+		if err != nil {
+			return err
+		}
+	}
+
+	// Make sure to check the error on Close.
+	err := w.Close()
+	if err != nil {
+		return err
+	}
+
+	err = ioutil.WriteFile(archiveName, buf.Bytes(), defaultFilePermissions)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/internals_xmlnode.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/internals_xmlnode.go
new file mode 100644
index 00000000..98588493
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/internals_xmlnode.go
@@ -0,0 +1,175 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"encoding/xml"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+)
+
+type xmlNode struct {
+	name       string
+	attributes map[string]string
+	children   []*xmlNode
+	value      string
+}
+
+func newNode() *xmlNode {
+	node := new(xmlNode)
+	node.children = make([]*xmlNode, 0)
+	node.attributes = make(map[string]string)
+	return node
+}
+
+func (node *xmlNode) String() string {
+	str := fmt.Sprintf("<%s", node.name)
+
+	for attrName, attrVal := range node.attributes {
+		str += fmt.Sprintf(" %s=\"%s\"", attrName, attrVal)
+	}
+
+	str += ">"
+	str += node.value
+
+	if len(node.children) != 0 {
+		for _, child := range node.children {
+			str += fmt.Sprintf("%s", child)
+		}
+	}
+
+	str += fmt.Sprintf("</%s>", node.name)
+
+	return str
+}
+
+func (node *xmlNode) unmarshal(startEl xml.StartElement) error {
+	node.name = startEl.Name.Local
+
+	for _, v := range startEl.Attr {
+		_, alreadyExists := node.attributes[v.Name.Local]
+		if alreadyExists {
+			return errors.New("tag '" + node.name + "' has duplicated attribute: '" + v.Name.Local + "'")
+		}
+		node.attributes[v.Name.Local] = v.Value
+	}
+
+	return nil
+}
+
+func (node *xmlNode) add(child *xmlNode) {
+	if node.children == nil {
+		node.children = make([]*xmlNode, 0)
+	}
+
+	node.children = append(node.children, child)
+}
+
+func (node *xmlNode) hasChildren() bool {
+	return node.children != nil && len(node.children) > 0
+}
+
+//=============================================
+
+func unmarshalConfig(reader io.Reader) (*xmlNode, error) {
+	xmlParser := xml.NewDecoder(reader)
+
+	config, err := unmarshalNode(xmlParser, nil)
+	if err != nil {
+		return nil, err
+	}
+	if config == nil {
+		return nil, errors.New("xml has no content")
+	}
+
+	nextConfigEntry, err := unmarshalNode(xmlParser, nil)
+	if nextConfigEntry != nil {
+		return nil, errors.New("xml contains more than one root element")
+	}
+
+	return config, nil
+}
+
+func unmarshalNode(xmlParser *xml.Decoder, curToken xml.Token) (node *xmlNode, err error) {
+	firstLoop := true
+	for {
+		var tok xml.Token
+		if firstLoop && curToken != nil {
+			tok = curToken
+			firstLoop = false
+		} else {
+			tok, err = getNextToken(xmlParser)
+			if err != nil || tok == nil {
+				return
+			}
+		}
+
+		switch tt := tok.(type) {
+		case xml.SyntaxError:
+			err = errors.New(tt.Error())
+			return
+		case xml.CharData:
+			value := strings.TrimSpace(string([]byte(tt)))
+			if node != nil {
+				node.value += value
+			}
+		case xml.StartElement:
+			if node == nil {
+				node = newNode()
+				err := node.unmarshal(tt)
+				if err != nil {
+					return nil, err
+				}
+			} else {
+				childNode, childErr := unmarshalNode(xmlParser, tok)
+				if childErr != nil {
+					return nil, childErr
+				}
+
+				if childNode != nil {
+					node.add(childNode)
+				} else {
+					return
+				}
+			}
+		case xml.EndElement:
+			return
+		}
+	}
+}
+
+func getNextToken(xmlParser *xml.Decoder) (tok xml.Token, err error) {
+	if tok, err = xmlParser.Token(); err != nil {
+		if err == io.EOF {
+			err = nil
+			return
+		}
+		return
+	}
+
+	return
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/log.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/log.go
new file mode 100644
index 00000000..f775e1fd
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/log.go
@@ -0,0 +1,307 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"errors"
+	"fmt"
+	"sync"
+	"time"
+)
+
+const (
+	staticFuncCallDepth = 3 // See 'commonLogger.log' method comments
+	loggerFuncCallDepth = 3
+)
+
+// Current is the logger used in all package level convenience funcs like 'Trace', 'Debug', 'Flush', etc.
+var Current LoggerInterface
+
+// Default logger that is created from an empty config: "<seelog/>". It is not closed by a ReplaceLogger call.
+var Default LoggerInterface
+
+// Disabled logger that doesn't produce any output in any circumstances. It is neither closed nor flushed by a ReplaceLogger call.
+var Disabled LoggerInterface
+
+var pkgOperationsMutex *sync.Mutex
+
+func init() {
+	pkgOperationsMutex = new(sync.Mutex)
+	var err error
+
+	if Default == nil {
+		Default, err = LoggerFromConfigAsBytes([]byte("<seelog />"))
+	}
+
+	if Disabled == nil {
+		Disabled, err = LoggerFromConfigAsBytes([]byte("<seelog levels=\"off\"/>"))
+	}
+
+	if err != nil {
+		panic(fmt.Sprintf("Seelog couldn't start. Error: %s", err.Error()))
+	}
+
+	Current = Default
+}
+
+func createLoggerFromFullConfig(config *configForParsing) (LoggerInterface, error) {
+	if config.LogType == syncloggerTypeFromString {
+		return NewSyncLogger(&config.logConfig), nil
+	} else if config.LogType == asyncLooploggerTypeFromString {
+		return NewAsyncLoopLogger(&config.logConfig), nil
+	} else if config.LogType == asyncTimerloggerTypeFromString {
+		logData := config.LoggerData
+		if logData == nil {
+			return nil, errors.New("async timer data not set")
+		}
+
+		asyncInt, ok := logData.(asyncTimerLoggerData)
+		if !ok {
+			return nil, errors.New("invalid async timer data")
+		}
+
+		logger, err := NewAsyncTimerLogger(&config.logConfig, time.Duration(asyncInt.AsyncInterval))
+		if !ok {
+			return nil, err
+		}
+
+		return logger, nil
+	} else if config.LogType == adaptiveLoggerTypeFromString {
+		logData := config.LoggerData
+		if logData == nil {
+			return nil, errors.New("adaptive logger parameters not set")
+		}
+
+		adaptData, ok := logData.(adaptiveLoggerData)
+		if !ok {
+			return nil, errors.New("invalid adaptive logger parameters")
+		}
+
+		logger, err := NewAsyncAdaptiveLogger(
+			&config.logConfig,
+			time.Duration(adaptData.MinInterval),
+			time.Duration(adaptData.MaxInterval),
+			adaptData.CriticalMsgCount,
+		)
+		if err != nil {
+			return nil, err
+		}
+
+		return logger, nil
+	}
+	return nil, errors.New("invalid config log type/data")
+}
+
+// UseLogger sets the 'Current' package level logger variable to the specified value.
+// This variable is used in all Trace/Debug/... package level convenience funcs.
+//
+// Example:
+//
+// after calling
+//     seelog.UseLogger(somelogger)
+// the following:
+//     seelog.Debug("abc")
+// will be equal to
+//     somelogger.Debug("abc")
+//
+// IMPORTANT: UseLogger do NOT close the previous logger (only flushes it). So if
+// you constantly use it to replace loggers and don't close them in other code, you'll
+// end up having memory leaks.
+//
+// To safely replace loggers, use ReplaceLogger.
+func UseLogger(logger LoggerInterface) error {
+	if logger == nil {
+		return errors.New("logger can not be nil")
+	}
+
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+
+	oldLogger := Current
+	Current = logger
+
+	if oldLogger != nil {
+		oldLogger.Flush()
+	}
+
+	return nil
+}
+
+// ReplaceLogger acts as UseLogger but the logger that was previously
+// used is disposed (except Default and Disabled loggers).
+//
+// Example:
+//     import log "github.com/cihub/seelog"
+//
+//     func main() {
+//         logger, err := log.LoggerFromConfigAsFile("seelog.xml")
+//
+//         if err != nil {
+//             panic(err)
+//         }
+//
+//         log.ReplaceLogger(logger)
+//         defer log.Flush()
+//
+//         log.Trace("test")
+//         log.Debugf("var = %s", "abc")
+//     }
+func ReplaceLogger(logger LoggerInterface) error {
+	if logger == nil {
+		return errors.New("logger can not be nil")
+	}
+
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+
+	defer func() {
+		if err := recover(); err != nil {
+			reportInternalError(fmt.Errorf("recovered from panic during ReplaceLogger: %s", err))
+		}
+	}()
+
+	if Current == Default {
+		Current.Flush()
+	} else if Current != nil && !Current.Closed() && Current != Disabled {
+		Current.Flush()
+		Current.Close()
+	}
+
+	Current = logger
+
+	return nil
+}
+
+// Tracef formats message according to format specifier
+// and writes to default logger with log level = Trace.
+func Tracef(format string, params ...interface{}) {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	Current.traceWithCallDepth(staticFuncCallDepth, newLogFormattedMessage(format, params))
+}
+
+// Debugf formats message according to format specifier
+// and writes to default logger with log level = Debug.
+func Debugf(format string, params ...interface{}) {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	Current.debugWithCallDepth(staticFuncCallDepth, newLogFormattedMessage(format, params))
+}
+
+// Infof formats message according to format specifier
+// and writes to default logger with log level = Info.
+func Infof(format string, params ...interface{}) {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	Current.infoWithCallDepth(staticFuncCallDepth, newLogFormattedMessage(format, params))
+}
+
+// Warnf formats message according to format specifier and writes to default logger with log level = Warn
+func Warnf(format string, params ...interface{}) error {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	message := newLogFormattedMessage(format, params)
+	Current.warnWithCallDepth(staticFuncCallDepth, message)
+	return errors.New(message.String())
+}
+
+// Errorf formats message according to format specifier and writes to default logger with log level = Error
+func Errorf(format string, params ...interface{}) error {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	message := newLogFormattedMessage(format, params)
+	Current.errorWithCallDepth(staticFuncCallDepth, message)
+	return errors.New(message.String())
+}
+
+// Criticalf formats message according to format specifier and writes to default logger with log level = Critical
+func Criticalf(format string, params ...interface{}) error {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	message := newLogFormattedMessage(format, params)
+	Current.criticalWithCallDepth(staticFuncCallDepth, message)
+	return errors.New(message.String())
+}
+
+// Trace formats message using the default formats for its operands and writes to default logger with log level = Trace
+func Trace(v ...interface{}) {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	Current.traceWithCallDepth(staticFuncCallDepth, newLogMessage(v))
+}
+
+// Debug formats message using the default formats for its operands and writes to default logger with log level = Debug
+func Debug(v ...interface{}) {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	Current.debugWithCallDepth(staticFuncCallDepth, newLogMessage(v))
+}
+
+// Info formats message using the default formats for its operands and writes to default logger with log level = Info
+func Info(v ...interface{}) {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	Current.infoWithCallDepth(staticFuncCallDepth, newLogMessage(v))
+}
+
+// Warn formats message using the default formats for its operands and writes to default logger with log level = Warn
+func Warn(v ...interface{}) error {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	message := newLogMessage(v)
+	Current.warnWithCallDepth(staticFuncCallDepth, message)
+	return errors.New(message.String())
+}
+
+// Error formats message using the default formats for its operands and writes to default logger with log level = Error
+func Error(v ...interface{}) error {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	message := newLogMessage(v)
+	Current.errorWithCallDepth(staticFuncCallDepth, message)
+	return errors.New(message.String())
+}
+
+// Critical formats message using the default formats for its operands and writes to default logger with log level = Critical
+func Critical(v ...interface{}) error {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	message := newLogMessage(v)
+	Current.criticalWithCallDepth(staticFuncCallDepth, message)
+	return errors.New(message.String())
+}
+
+// Flush immediately processes all currently queued messages and all currently buffered messages.
+// It is a blocking call which returns only after the queue is empty and all the buffers are empty.
+//
+// If Flush is called for a synchronous logger (type='sync'), it only flushes buffers (e.g. '<buffered>' receivers)
+// , because there is no queue.
+//
+// Call this method when your app is going to shut down not to lose any log messages.
+func Flush() {
+	pkgOperationsMutex.Lock()
+	defer pkgOperationsMutex.Unlock()
+	Current.Flush()
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/logger.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/logger.go
new file mode 100644
index 00000000..fc96aed4
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/logger.go
@@ -0,0 +1,370 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"sync"
+)
+
+func reportInternalError(err error) {
+	fmt.Fprintf(os.Stderr, "seelog internal error: %s\n", err)
+}
+
+// LoggerInterface represents structs capable of logging Seelog messages
+type LoggerInterface interface {
+
+	// Tracef formats message according to format specifier
+	// and writes to log with level = Trace.
+	Tracef(format string, params ...interface{})
+
+	// Debugf formats message according to format specifier
+	// and writes to log with level = Debug.
+	Debugf(format string, params ...interface{})
+
+	// Infof formats message according to format specifier
+	// and writes to log with level = Info.
+	Infof(format string, params ...interface{})
+
+	// Warnf formats message according to format specifier
+	// and writes to log with level = Warn.
+	Warnf(format string, params ...interface{}) error
+
+	// Errorf formats message according to format specifier
+	// and writes to log with level = Error.
+	Errorf(format string, params ...interface{}) error
+
+	// Criticalf formats message according to format specifier
+	// and writes to log with level = Critical.
+	Criticalf(format string, params ...interface{}) error
+
+	// Trace formats message using the default formats for its operands
+	// and writes to log with level = Trace
+	Trace(v ...interface{})
+
+	// Debug formats message using the default formats for its operands
+	// and writes to log with level = Debug
+	Debug(v ...interface{})
+
+	// Info formats message using the default formats for its operands
+	// and writes to log with level = Info
+	Info(v ...interface{})
+
+	// Warn formats message using the default formats for its operands
+	// and writes to log with level = Warn
+	Warn(v ...interface{}) error
+
+	// Error formats message using the default formats for its operands
+	// and writes to log with level = Error
+	Error(v ...interface{}) error
+
+	// Critical formats message using the default formats for its operands
+	// and writes to log with level = Critical
+	Critical(v ...interface{}) error
+
+	traceWithCallDepth(callDepth int, message fmt.Stringer)
+	debugWithCallDepth(callDepth int, message fmt.Stringer)
+	infoWithCallDepth(callDepth int, message fmt.Stringer)
+	warnWithCallDepth(callDepth int, message fmt.Stringer)
+	errorWithCallDepth(callDepth int, message fmt.Stringer)
+	criticalWithCallDepth(callDepth int, message fmt.Stringer)
+
+	// Close flushes all the messages in the logger and closes it. It cannot be used after this operation.
+	Close()
+
+	// Flush flushes all the messages in the logger.
+	Flush()
+
+	// Closed returns true if the logger was previously closed.
+	Closed() bool
+
+	// SetAdditionalStackDepth sets the additional number of frames to skip by runtime.Caller
+	// when getting function information needed to print seelog format identifiers such as %Func or %File.
+	//
+	// This func may be used when you wrap seelog funcs and want to print caller info of you own
+	// wrappers instead of seelog func callers. In this case you should set depth = 1. If you then
+	// wrap your wrapper, you should set depth = 2, etc.
+	//
+	// NOTE: Incorrect depth value may lead to errors in runtime.Caller evaluation or incorrect
+	// function/file names in log files. Do not use it if you are not going to wrap seelog funcs.
+	// You may reset the value to default using a SetAdditionalStackDepth(0) call.
+	SetAdditionalStackDepth(depth int) error
+
+	// Sets logger context that can be used in formatter funcs and custom receivers
+	SetContext(context interface{})
+}
+
+// innerLoggerInterface is an internal logging interface
+type innerLoggerInterface interface {
+	innerLog(level LogLevel, context LogContextInterface, message fmt.Stringer)
+	Flush()
+}
+
+// [file path][func name][level] -> [allowed]
+type allowedContextCache map[string]map[string]map[LogLevel]bool
+
+// commonLogger contains all common data needed for logging and contains methods used to log messages.
+type commonLogger struct {
+	config        *logConfig          // Config used for logging
+	contextCache  allowedContextCache // Caches whether log is enabled for specific "full path-func name-level" sets
+	closed        bool                // 'true' when all writers are closed, all data is flushed, logger is unusable. Must be accessed while holding closedM
+	closedM       sync.RWMutex
+	m             sync.Mutex // Mutex for main operations
+	unusedLevels  []bool
+	innerLogger   innerLoggerInterface
+	addStackDepth int // Additional stack depth needed for correct seelog caller context detection
+	customContext interface{}
+}
+
+func newCommonLogger(config *logConfig, internalLogger innerLoggerInterface) *commonLogger {
+	cLogger := new(commonLogger)
+
+	cLogger.config = config
+	cLogger.contextCache = make(allowedContextCache)
+	cLogger.unusedLevels = make([]bool, Off)
+	cLogger.fillUnusedLevels()
+	cLogger.innerLogger = internalLogger
+
+	return cLogger
+}
+
+func (cLogger *commonLogger) SetAdditionalStackDepth(depth int) error {
+	if depth < 0 {
+		return fmt.Errorf("negative depth: %d", depth)
+	}
+	cLogger.m.Lock()
+	cLogger.addStackDepth = depth
+	cLogger.m.Unlock()
+	return nil
+}
+
+func (cLogger *commonLogger) Tracef(format string, params ...interface{}) {
+	cLogger.traceWithCallDepth(loggerFuncCallDepth, newLogFormattedMessage(format, params))
+}
+
+func (cLogger *commonLogger) Debugf(format string, params ...interface{}) {
+	cLogger.debugWithCallDepth(loggerFuncCallDepth, newLogFormattedMessage(format, params))
+}
+
+func (cLogger *commonLogger) Infof(format string, params ...interface{}) {
+	cLogger.infoWithCallDepth(loggerFuncCallDepth, newLogFormattedMessage(format, params))
+}
+
+func (cLogger *commonLogger) Warnf(format string, params ...interface{}) error {
+	message := newLogFormattedMessage(format, params)
+	cLogger.warnWithCallDepth(loggerFuncCallDepth, message)
+	return errors.New(message.String())
+}
+
+func (cLogger *commonLogger) Errorf(format string, params ...interface{}) error {
+	message := newLogFormattedMessage(format, params)
+	cLogger.errorWithCallDepth(loggerFuncCallDepth, message)
+	return errors.New(message.String())
+}
+
+func (cLogger *commonLogger) Criticalf(format string, params ...interface{}) error {
+	message := newLogFormattedMessage(format, params)
+	cLogger.criticalWithCallDepth(loggerFuncCallDepth, message)
+	return errors.New(message.String())
+}
+
+func (cLogger *commonLogger) Trace(v ...interface{}) {
+	cLogger.traceWithCallDepth(loggerFuncCallDepth, newLogMessage(v))
+}
+
+func (cLogger *commonLogger) Debug(v ...interface{}) {
+	cLogger.debugWithCallDepth(loggerFuncCallDepth, newLogMessage(v))
+}
+
+func (cLogger *commonLogger) Info(v ...interface{}) {
+	cLogger.infoWithCallDepth(loggerFuncCallDepth, newLogMessage(v))
+}
+
+func (cLogger *commonLogger) Warn(v ...interface{}) error {
+	message := newLogMessage(v)
+	cLogger.warnWithCallDepth(loggerFuncCallDepth, message)
+	return errors.New(message.String())
+}
+
+func (cLogger *commonLogger) Error(v ...interface{}) error {
+	message := newLogMessage(v)
+	cLogger.errorWithCallDepth(loggerFuncCallDepth, message)
+	return errors.New(message.String())
+}
+
+func (cLogger *commonLogger) Critical(v ...interface{}) error {
+	message := newLogMessage(v)
+	cLogger.criticalWithCallDepth(loggerFuncCallDepth, message)
+	return errors.New(message.String())
+}
+
+func (cLogger *commonLogger) SetContext(c interface{}) {
+	cLogger.customContext = c
+}
+
+func (cLogger *commonLogger) traceWithCallDepth(callDepth int, message fmt.Stringer) {
+	cLogger.log(TraceLvl, message, callDepth)
+}
+
+func (cLogger *commonLogger) debugWithCallDepth(callDepth int, message fmt.Stringer) {
+	cLogger.log(DebugLvl, message, callDepth)
+}
+
+func (cLogger *commonLogger) infoWithCallDepth(callDepth int, message fmt.Stringer) {
+	cLogger.log(InfoLvl, message, callDepth)
+}
+
+func (cLogger *commonLogger) warnWithCallDepth(callDepth int, message fmt.Stringer) {
+	cLogger.log(WarnLvl, message, callDepth)
+}
+
+func (cLogger *commonLogger) errorWithCallDepth(callDepth int, message fmt.Stringer) {
+	cLogger.log(ErrorLvl, message, callDepth)
+}
+
+func (cLogger *commonLogger) criticalWithCallDepth(callDepth int, message fmt.Stringer) {
+	cLogger.log(CriticalLvl, message, callDepth)
+	cLogger.innerLogger.Flush()
+}
+
+func (cLogger *commonLogger) Closed() bool {
+	cLogger.closedM.RLock()
+	defer cLogger.closedM.RUnlock()
+	return cLogger.closed
+}
+
+func (cLogger *commonLogger) fillUnusedLevels() {
+	for i := 0; i < len(cLogger.unusedLevels); i++ {
+		cLogger.unusedLevels[i] = true
+	}
+
+	cLogger.fillUnusedLevelsByContraint(cLogger.config.Constraints)
+
+	for _, exception := range cLogger.config.Exceptions {
+		cLogger.fillUnusedLevelsByContraint(exception)
+	}
+}
+
+func (cLogger *commonLogger) fillUnusedLevelsByContraint(constraint logLevelConstraints) {
+	for i := 0; i < len(cLogger.unusedLevels); i++ {
+		if constraint.IsAllowed(LogLevel(i)) {
+			cLogger.unusedLevels[i] = false
+		}
+	}
+}
+
+// stackCallDepth is used to indicate the call depth of 'log' func.
+// This depth level is used in the runtime.Caller(...) call. See
+// common_context.go -> specifyContext, extractCallerInfo for details.
+func (cLogger *commonLogger) log(level LogLevel, message fmt.Stringer, stackCallDepth int) {
+	if cLogger.unusedLevels[level] {
+		return
+	}
+	cLogger.m.Lock()
+	defer cLogger.m.Unlock()
+
+	if cLogger.Closed() {
+		return
+	}
+	context, _ := specifyContext(stackCallDepth+cLogger.addStackDepth, cLogger.customContext)
+	// Context errors are not reported because there are situations
+	// in which context errors are normal Seelog usage cases. For
+	// example in executables with stripped symbols.
+	// Error contexts are returned instead. See common_context.go.
+	/*if err != nil {
+		reportInternalError(err)
+		return
+	}*/
+	cLogger.innerLogger.innerLog(level, context, message)
+}
+
+func (cLogger *commonLogger) processLogMsg(level LogLevel, message fmt.Stringer, context LogContextInterface) {
+	defer func() {
+		if err := recover(); err != nil {
+			reportInternalError(fmt.Errorf("recovered from panic during message processing: %s", err))
+		}
+	}()
+	if cLogger.config.IsAllowed(level, context) {
+		cLogger.config.RootDispatcher.Dispatch(message.String(), level, context, reportInternalError)
+	}
+}
+
+func (cLogger *commonLogger) isAllowed(level LogLevel, context LogContextInterface) bool {
+	funcMap, ok := cLogger.contextCache[context.FullPath()]
+	if !ok {
+		funcMap = make(map[string]map[LogLevel]bool, 0)
+		cLogger.contextCache[context.FullPath()] = funcMap
+	}
+
+	levelMap, ok := funcMap[context.Func()]
+	if !ok {
+		levelMap = make(map[LogLevel]bool, 0)
+		funcMap[context.Func()] = levelMap
+	}
+
+	isAllowValue, ok := levelMap[level]
+	if !ok {
+		isAllowValue = cLogger.config.IsAllowed(level, context)
+		levelMap[level] = isAllowValue
+	}
+
+	return isAllowValue
+}
+
+type logMessage struct {
+	params []interface{}
+}
+
+type logFormattedMessage struct {
+	format string
+	params []interface{}
+}
+
+func newLogMessage(params []interface{}) fmt.Stringer {
+	message := new(logMessage)
+
+	message.params = params
+
+	return message
+}
+
+func newLogFormattedMessage(format string, params []interface{}) *logFormattedMessage {
+	message := new(logFormattedMessage)
+
+	message.params = params
+	message.format = format
+
+	return message
+}
+
+func (message *logMessage) String() string {
+	return fmt.Sprint(message.params...)
+}
+
+func (message *logFormattedMessage) String() string {
+	return fmt.Sprintf(message.format, message.params...)
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/writers_bufferedwriter.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/writers_bufferedwriter.go
new file mode 100644
index 00000000..37d75c82
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/writers_bufferedwriter.go
@@ -0,0 +1,161 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"io"
+	"sync"
+	"time"
+)
+
+// bufferedWriter stores data in memory and flushes it every flushPeriod or when buffer is full
+type bufferedWriter struct {
+	flushPeriod time.Duration // data flushes interval (in microseconds)
+	bufferMutex *sync.Mutex   // mutex for buffer operations syncronization
+	innerWriter io.Writer     // inner writer
+	buffer      *bufio.Writer // buffered wrapper for inner writer
+	bufferSize  int           // max size of data chunk in bytes
+}
+
+// NewBufferedWriter creates a new buffered writer struct.
+// bufferSize -- size of memory buffer in bytes
+// flushPeriod -- period in which data flushes from memory buffer in milliseconds. 0 - turn off this functionality
+func NewBufferedWriter(innerWriter io.Writer, bufferSize int, flushPeriod time.Duration) (*bufferedWriter, error) {
+
+	if innerWriter == nil {
+		return nil, errors.New("argument is nil: innerWriter")
+	}
+	if flushPeriod < 0 {
+		return nil, fmt.Errorf("flushPeriod can not be less than 0. Got: %d", flushPeriod)
+	}
+
+	if bufferSize <= 0 {
+		return nil, fmt.Errorf("bufferSize can not be less or equal to 0. Got: %d", bufferSize)
+	}
+
+	buffer := bufio.NewWriterSize(innerWriter, bufferSize)
+
+	/*if err != nil {
+		return nil, err
+	}*/
+
+	newWriter := new(bufferedWriter)
+
+	newWriter.innerWriter = innerWriter
+	newWriter.buffer = buffer
+	newWriter.bufferSize = bufferSize
+	newWriter.flushPeriod = flushPeriod * 1e6
+	newWriter.bufferMutex = new(sync.Mutex)
+
+	if flushPeriod != 0 {
+		go newWriter.flushPeriodically()
+	}
+
+	return newWriter, nil
+}
+
+func (bufWriter *bufferedWriter) writeBigChunk(bytes []byte) (n int, err error) {
+	bufferedLen := bufWriter.buffer.Buffered()
+
+	n, err = bufWriter.flushInner()
+	if err != nil {
+		return
+	}
+
+	written, writeErr := bufWriter.innerWriter.Write(bytes)
+	return bufferedLen + written, writeErr
+}
+
+// Sends data to buffer manager. Waits until all buffers are full.
+func (bufWriter *bufferedWriter) Write(bytes []byte) (n int, err error) {
+
+	bufWriter.bufferMutex.Lock()
+	defer bufWriter.bufferMutex.Unlock()
+
+	bytesLen := len(bytes)
+
+	if bytesLen > bufWriter.bufferSize {
+		return bufWriter.writeBigChunk(bytes)
+	}
+
+	if bytesLen > bufWriter.buffer.Available() {
+		n, err = bufWriter.flushInner()
+		if err != nil {
+			return
+		}
+	}
+
+	bufWriter.buffer.Write(bytes)
+
+	return len(bytes), nil
+}
+
+func (bufWriter *bufferedWriter) Close() error {
+	closer, ok := bufWriter.innerWriter.(io.Closer)
+	if ok {
+		return closer.Close()
+	}
+
+	return nil
+}
+
+func (bufWriter *bufferedWriter) Flush() {
+
+	bufWriter.bufferMutex.Lock()
+	defer bufWriter.bufferMutex.Unlock()
+
+	bufWriter.flushInner()
+}
+
+func (bufWriter *bufferedWriter) flushInner() (n int, err error) {
+	bufferedLen := bufWriter.buffer.Buffered()
+	flushErr := bufWriter.buffer.Flush()
+
+	return bufWriter.buffer.Buffered() - bufferedLen, flushErr
+}
+
+func (bufWriter *bufferedWriter) flushBuffer() {
+	bufWriter.bufferMutex.Lock()
+	defer bufWriter.bufferMutex.Unlock()
+
+	bufWriter.buffer.Flush()
+}
+
+func (bufWriter *bufferedWriter) flushPeriodically() {
+	if bufWriter.flushPeriod > 0 {
+		ticker := time.NewTicker(bufWriter.flushPeriod)
+		for {
+			<-ticker.C
+			bufWriter.flushBuffer()
+		}
+	}
+}
+
+func (bufWriter *bufferedWriter) String() string {
+	return fmt.Sprintf("bufferedWriter size: %d, flushPeriod: %d", bufWriter.bufferSize, bufWriter.flushPeriod)
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/writers_connwriter.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/writers_connwriter.go
new file mode 100644
index 00000000..d199894e
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/writers_connwriter.go
@@ -0,0 +1,144 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"crypto/tls"
+	"fmt"
+	"io"
+	"net"
+)
+
+// connWriter is used to write to a stream-oriented network connection.
+type connWriter struct {
+	innerWriter    io.WriteCloser
+	reconnectOnMsg bool
+	reconnect      bool
+	net            string
+	addr           string
+	useTLS         bool
+	configTLS      *tls.Config
+}
+
+// Creates writer to the address addr on the network netName.
+// Connection will be opened on each write if reconnectOnMsg = true
+func NewConnWriter(netName string, addr string, reconnectOnMsg bool) *connWriter {
+	newWriter := new(connWriter)
+
+	newWriter.net = netName
+	newWriter.addr = addr
+	newWriter.reconnectOnMsg = reconnectOnMsg
+
+	return newWriter
+}
+
+// Creates a writer that uses SSL/TLS
+func newTLSWriter(netName string, addr string, reconnectOnMsg bool, config *tls.Config) *connWriter {
+	newWriter := new(connWriter)
+
+	newWriter.net = netName
+	newWriter.addr = addr
+	newWriter.reconnectOnMsg = reconnectOnMsg
+	newWriter.useTLS = true
+	newWriter.configTLS = config
+
+	return newWriter
+}
+
+func (connWriter *connWriter) Close() error {
+	if connWriter.innerWriter == nil {
+		return nil
+	}
+
+	return connWriter.innerWriter.Close()
+}
+
+func (connWriter *connWriter) Write(bytes []byte) (n int, err error) {
+	if connWriter.neededConnectOnMsg() {
+		err = connWriter.connect()
+		if err != nil {
+			return 0, err
+		}
+	}
+
+	if connWriter.reconnectOnMsg {
+		defer connWriter.innerWriter.Close()
+	}
+
+	n, err = connWriter.innerWriter.Write(bytes)
+	if err != nil {
+		connWriter.reconnect = true
+	}
+
+	return
+}
+
+func (connWriter *connWriter) String() string {
+	return fmt.Sprintf("Conn writer: [%s, %s, %v]", connWriter.net, connWriter.addr, connWriter.reconnectOnMsg)
+}
+
+func (connWriter *connWriter) connect() error {
+	if connWriter.innerWriter != nil {
+		connWriter.innerWriter.Close()
+		connWriter.innerWriter = nil
+	}
+
+	if connWriter.useTLS {
+		conn, err := tls.Dial(connWriter.net, connWriter.addr, connWriter.configTLS)
+		if err != nil {
+			return err
+		}
+		connWriter.innerWriter = conn
+
+		return nil
+	}
+
+	conn, err := net.Dial(connWriter.net, connWriter.addr)
+	if err != nil {
+		return err
+	}
+
+	tcpConn, ok := conn.(*net.TCPConn)
+	if ok {
+		tcpConn.SetKeepAlive(true)
+	}
+
+	connWriter.innerWriter = conn
+
+	return nil
+}
+
+func (connWriter *connWriter) neededConnectOnMsg() bool {
+	if connWriter.reconnect {
+		connWriter.reconnect = false
+		return true
+	}
+
+	if connWriter.innerWriter == nil {
+		return true
+	}
+
+	return connWriter.reconnectOnMsg
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/writers_consolewriter.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/writers_consolewriter.go
new file mode 100644
index 00000000..3eb79afa
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/writers_consolewriter.go
@@ -0,0 +1,47 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import "fmt"
+
+// consoleWriter is used to write to console
+type consoleWriter struct {
+}
+
+// Creates a new console writer. Returns error, if the console writer couldn't be created.
+func NewConsoleWriter() (writer *consoleWriter, err error) {
+	newWriter := new(consoleWriter)
+
+	return newWriter, nil
+}
+
+// Create folder and file on WriteLog/Write first call
+func (console *consoleWriter) Write(bytes []byte) (int, error) {
+	return fmt.Print(string(bytes))
+}
+
+func (console *consoleWriter) String() string {
+	return "Console writer"
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/writers_filewriter.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/writers_filewriter.go
new file mode 100644
index 00000000..8d3ae270
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/writers_filewriter.go
@@ -0,0 +1,92 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+)
+
+// fileWriter is used to write to a file.
+type fileWriter struct {
+	innerWriter io.WriteCloser
+	fileName    string
+}
+
+// Creates a new file and a corresponding writer. Returns error, if the file couldn't be created.
+func NewFileWriter(fileName string) (writer *fileWriter, err error) {
+	newWriter := new(fileWriter)
+	newWriter.fileName = fileName
+
+	return newWriter, nil
+}
+
+func (fw *fileWriter) Close() error {
+	if fw.innerWriter != nil {
+		err := fw.innerWriter.Close()
+		if err != nil {
+			return err
+		}
+		fw.innerWriter = nil
+	}
+	return nil
+}
+
+// Create folder and file on WriteLog/Write first call
+func (fw *fileWriter) Write(bytes []byte) (n int, err error) {
+	if fw.innerWriter == nil {
+		if err := fw.createFile(); err != nil {
+			return 0, err
+		}
+	}
+	return fw.innerWriter.Write(bytes)
+}
+
+func (fw *fileWriter) createFile() error {
+	folder, _ := filepath.Split(fw.fileName)
+	var err error
+
+	if 0 != len(folder) {
+		err = os.MkdirAll(folder, defaultDirectoryPermissions)
+		if err != nil {
+			return err
+		}
+	}
+
+	// If exists
+	fw.innerWriter, err = os.OpenFile(fw.fileName, os.O_WRONLY|os.O_APPEND|os.O_CREATE, defaultFilePermissions)
+
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (fw *fileWriter) String() string {
+	return fmt.Sprintf("File writer: %s", fw.fileName)
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/writers_formattedwriter.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/writers_formattedwriter.go
new file mode 100644
index 00000000..bf44a410
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/writers_formattedwriter.go
@@ -0,0 +1,62 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"errors"
+	"fmt"
+	"io"
+)
+
+type formattedWriter struct {
+	writer    io.Writer
+	formatter *formatter
+}
+
+func NewFormattedWriter(writer io.Writer, formatter *formatter) (*formattedWriter, error) {
+	if formatter == nil {
+		return nil, errors.New("formatter can not be nil")
+	}
+
+	return &formattedWriter{writer, formatter}, nil
+}
+
+func (formattedWriter *formattedWriter) Write(message string, level LogLevel, context LogContextInterface) error {
+	str := formattedWriter.formatter.Format(message, level, context)
+	_, err := formattedWriter.writer.Write([]byte(str))
+	return err
+}
+
+func (formattedWriter *formattedWriter) String() string {
+	return fmt.Sprintf("writer: %s, format: %s", formattedWriter.writer, formattedWriter.formatter)
+}
+
+func (formattedWriter *formattedWriter) Writer() io.Writer {
+	return formattedWriter.writer
+}
+
+func (formattedWriter *formattedWriter) Format() *formatter {
+	return formattedWriter.formatter
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/writers_rollingfilewriter.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/writers_rollingfilewriter.go
new file mode 100644
index 00000000..2422a67c
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/writers_rollingfilewriter.go
@@ -0,0 +1,625 @@
+// Copyright (c) 2013 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// Common constants
+const (
+	rollingLogHistoryDelimiter = "."
+)
+
+// Types of the rolling writer: roll by date, by time, etc.
+type rollingType uint8
+
+const (
+	rollingTypeSize = iota
+	rollingTypeTime
+)
+
+// Types of the rolled file naming mode: prefix, postfix, etc.
+type rollingNameMode uint8
+
+const (
+	rollingNameModePostfix = iota
+	rollingNameModePrefix
+)
+
+var rollingNameModesStringRepresentation = map[rollingNameMode]string{
+	rollingNameModePostfix: "postfix",
+	rollingNameModePrefix:  "prefix",
+}
+
+func rollingNameModeFromString(rollingNameStr string) (rollingNameMode, bool) {
+	for tp, tpStr := range rollingNameModesStringRepresentation {
+		if tpStr == rollingNameStr {
+			return tp, true
+		}
+	}
+
+	return 0, false
+}
+
+type rollingIntervalType uint8
+
+const (
+	rollingIntervalAny = iota
+	rollingIntervalDaily
+)
+
+var rollingInvervalTypesStringRepresentation = map[rollingIntervalType]string{
+	rollingIntervalDaily: "daily",
+}
+
+func rollingIntervalTypeFromString(rollingTypeStr string) (rollingIntervalType, bool) {
+	for tp, tpStr := range rollingInvervalTypesStringRepresentation {
+		if tpStr == rollingTypeStr {
+			return tp, true
+		}
+	}
+
+	return 0, false
+}
+
+var rollingTypesStringRepresentation = map[rollingType]string{
+	rollingTypeSize: "size",
+	rollingTypeTime: "date",
+}
+
+func rollingTypeFromString(rollingTypeStr string) (rollingType, bool) {
+	for tp, tpStr := range rollingTypesStringRepresentation {
+		if tpStr == rollingTypeStr {
+			return tp, true
+		}
+	}
+
+	return 0, false
+}
+
+// Old logs archivation type.
+type rollingArchiveType uint8
+
+const (
+	rollingArchiveNone = iota
+	rollingArchiveZip
+)
+
+var rollingArchiveTypesStringRepresentation = map[rollingArchiveType]string{
+	rollingArchiveNone: "none",
+	rollingArchiveZip:  "zip",
+}
+
+func rollingArchiveTypeFromString(rollingArchiveTypeStr string) (rollingArchiveType, bool) {
+	for tp, tpStr := range rollingArchiveTypesStringRepresentation {
+		if tpStr == rollingArchiveTypeStr {
+			return tp, true
+		}
+	}
+
+	return 0, false
+}
+
+// Default names for different archivation types
+var rollingArchiveTypesDefaultNames = map[rollingArchiveType]string{
+	rollingArchiveZip: "log.zip",
+}
+
+// rollerVirtual is an interface that represents all virtual funcs that are
+// called in different rolling writer subtypes.
+type rollerVirtual interface {
+	needsToRoll() (bool, error)                         // Returns true if needs to switch to another file.
+	isFileRollNameValid(rname string) bool              // Returns true if logger roll file name (postfix/prefix/etc.) is ok.
+	sortFileRollNamesAsc(fs []string) ([]string, error) // Sorts logger roll file names in ascending order of their creation by logger.
+
+	// Creates a new froll history file using the contents of current file and special filename of the latest roll (prefix/ postfix).
+	// If lastRollName is empty (""), then it means that there is no latest roll (current is the first one)
+	getNewHistoryRollFileName(lastRollName string) string
+	getCurrentModifiedFileName(originalFileName string, first bool) (string, error) // Returns filename modified according to specific logger rules
+}
+
+// rollingFileWriter writes received messages to a file, until time interval passes
+// or file exceeds a specified limit. After that the current log file is renamed
+// and writer starts to log into a new file. You can set a limit for such renamed
+// files count, if you want, and then the rolling writer would delete older ones when
+// the files count exceed the specified limit.
+type rollingFileWriter struct {
+	fileName         string // current file name. May differ from original in date rolling loggers
+	originalFileName string // original one
+	currentDirPath   string
+	currentFile      *os.File
+	currentFileSize  int64
+	rollingType      rollingType // Rolling mode (Files roll by size/date/...)
+	archiveType      rollingArchiveType
+	archivePath      string
+	maxRolls         int
+	nameMode         rollingNameMode
+	self             rollerVirtual // Used for virtual calls
+}
+
+func newRollingFileWriter(fpath string, rtype rollingType, atype rollingArchiveType, apath string, maxr int, namemode rollingNameMode) (*rollingFileWriter, error) {
+	rw := new(rollingFileWriter)
+	rw.currentDirPath, rw.fileName = filepath.Split(fpath)
+	if len(rw.currentDirPath) == 0 {
+		rw.currentDirPath = "."
+	}
+	rw.originalFileName = rw.fileName
+
+	rw.rollingType = rtype
+	rw.archiveType = atype
+	rw.archivePath = apath
+	rw.nameMode = namemode
+	rw.maxRolls = maxr
+	return rw, nil
+}
+
+func (rw *rollingFileWriter) hasRollName(file string) bool {
+	switch rw.nameMode {
+	case rollingNameModePostfix:
+		rname := rw.originalFileName + rollingLogHistoryDelimiter
+		return strings.HasPrefix(file, rname)
+	case rollingNameModePrefix:
+		rname := rollingLogHistoryDelimiter + rw.originalFileName
+		return strings.HasSuffix(file, rname)
+	}
+	return false
+}
+
+func (rw *rollingFileWriter) createFullFileName(originalName, rollname string) string {
+	switch rw.nameMode {
+	case rollingNameModePostfix:
+		return originalName + rollingLogHistoryDelimiter + rollname
+	case rollingNameModePrefix:
+		return rollname + rollingLogHistoryDelimiter + originalName
+	}
+	return ""
+}
+
+func (rw *rollingFileWriter) getSortedLogHistory() ([]string, error) {
+	files, err := getDirFilePaths(rw.currentDirPath, nil, true)
+	if err != nil {
+		return nil, err
+	}
+	var validRollNames []string
+	for _, file := range files {
+		if file != rw.fileName && rw.hasRollName(file) {
+			rname := rw.getFileRollName(file)
+			if rw.self.isFileRollNameValid(rname) {
+				validRollNames = append(validRollNames, rname)
+			}
+		}
+	}
+	sortedTails, err := rw.self.sortFileRollNamesAsc(validRollNames)
+	if err != nil {
+		return nil, err
+	}
+	validSortedFiles := make([]string, len(sortedTails))
+	for i, v := range sortedTails {
+		validSortedFiles[i] = rw.createFullFileName(rw.originalFileName, v)
+	}
+	return validSortedFiles, nil
+}
+
+func (rw *rollingFileWriter) createFileAndFolderIfNeeded(first bool) error {
+	var err error
+
+	if len(rw.currentDirPath) != 0 {
+		err = os.MkdirAll(rw.currentDirPath, defaultDirectoryPermissions)
+
+		if err != nil {
+			return err
+		}
+	}
+
+	rw.fileName, err = rw.self.getCurrentModifiedFileName(rw.originalFileName, first)
+	if err != nil {
+		return err
+	}
+	filePath := filepath.Join(rw.currentDirPath, rw.fileName)
+
+	// If exists
+	stat, err := os.Lstat(filePath)
+	if err == nil {
+		rw.currentFile, err = os.OpenFile(filePath, os.O_WRONLY|os.O_APPEND, defaultFilePermissions)
+
+		stat, err = os.Lstat(filePath)
+		if err != nil {
+			return err
+		}
+
+		rw.currentFileSize = stat.Size()
+	} else {
+		rw.currentFile, err = os.Create(filePath)
+		rw.currentFileSize = 0
+	}
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (rw *rollingFileWriter) deleteOldRolls(history []string) error {
+	if rw.maxRolls <= 0 {
+		return nil
+	}
+
+	rollsToDelete := len(history) - rw.maxRolls
+	if rollsToDelete <= 0 {
+		return nil
+	}
+
+	switch rw.archiveType {
+	case rollingArchiveZip:
+		var files map[string][]byte
+
+		// If archive exists
+		_, err := os.Lstat(rw.archivePath)
+		if nil == err {
+			// Extract files and content from it
+			files, err = unzip(rw.archivePath)
+			if err != nil {
+				return err
+			}
+
+			// Remove the original file
+			err = tryRemoveFile(rw.archivePath)
+			if err != nil {
+				return err
+			}
+		} else {
+			files = make(map[string][]byte)
+		}
+
+		// Add files to the existing files map, filled above
+		for i := 0; i < rollsToDelete; i++ {
+			rollPath := filepath.Join(rw.currentDirPath, history[i])
+			bts, err := ioutil.ReadFile(rollPath)
+			if err != nil {
+				return err
+			}
+
+			files[rollPath] = bts
+		}
+
+		// Put the final file set to zip file.
+		if err = createZip(rw.archivePath, files); err != nil {
+			return err
+		}
+	}
+	var err error
+	// In all cases (archive files or not) the files should be deleted.
+	for i := 0; i < rollsToDelete; i++ {
+		// Try best to delete files without breaking the loop.
+		if err = tryRemoveFile(filepath.Join(rw.currentDirPath, history[i])); err != nil {
+			reportInternalError(err)
+		}
+	}
+
+	return nil
+}
+
+func (rw *rollingFileWriter) getFileRollName(fileName string) string {
+	switch rw.nameMode {
+	case rollingNameModePostfix:
+		return fileName[len(rw.originalFileName+rollingLogHistoryDelimiter):]
+	case rollingNameModePrefix:
+		return fileName[:len(fileName)-len(rw.originalFileName+rollingLogHistoryDelimiter)]
+	}
+	return ""
+}
+
+func (rw *rollingFileWriter) Write(bytes []byte) (n int, err error) {
+	if rw.currentFile == nil {
+		err := rw.createFileAndFolderIfNeeded(true)
+		if err != nil {
+			return 0, err
+		}
+	}
+	// needs to roll if:
+	//   * file roller max file size exceeded OR
+	//   * time roller interval passed
+	nr, err := rw.self.needsToRoll()
+	if err != nil {
+		return 0, err
+	}
+	if nr {
+		// First, close current file.
+		err = rw.currentFile.Close()
+		if err != nil {
+			return 0, err
+		}
+		// Current history of all previous log files.
+		// For file roller it may be like this:
+		//     * ...
+		//     * file.log.4
+		//     * file.log.5
+		//     * file.log.6
+		//
+		// For date roller it may look like this:
+		//     * ...
+		//     * file.log.11.Aug.13
+		//     * file.log.15.Aug.13
+		//     * file.log.16.Aug.13
+		// Sorted log history does NOT include current file.
+		history, err := rw.getSortedLogHistory()
+		if err != nil {
+			return 0, err
+		}
+		// Renames current file to create a new roll history entry
+		// For file roller it may be like this:
+		//     * ...
+		//     * file.log.4
+		//     * file.log.5
+		//     * file.log.6
+		//     n file.log.7  <---- RENAMED (from file.log)
+		// Time rollers that doesn't modify file names (e.g. 'date' roller) skip this logic.
+		var newHistoryName string
+		var newRollMarkerName string
+		if len(history) > 0 {
+			// Create new rname name using last history file name
+			newRollMarkerName = rw.self.getNewHistoryRollFileName(rw.getFileRollName(history[len(history)-1]))
+		} else {
+			// Create first rname name
+			newRollMarkerName = rw.self.getNewHistoryRollFileName("")
+		}
+		if len(newRollMarkerName) != 0 {
+			newHistoryName = rw.createFullFileName(rw.fileName, newRollMarkerName)
+		} else {
+			newHistoryName = rw.fileName
+		}
+		if newHistoryName != rw.fileName {
+			err = os.Rename(filepath.Join(rw.currentDirPath, rw.fileName), filepath.Join(rw.currentDirPath, newHistoryName))
+			if err != nil {
+				return 0, err
+			}
+		}
+		// Finally, add the newly added history file to the history archive
+		// and, if after that the archive exceeds the allowed max limit, older rolls
+		// must the removed/archived.
+		history = append(history, newHistoryName)
+		if len(history) > rw.maxRolls {
+			err = rw.deleteOldRolls(history)
+			if err != nil {
+				return 0, err
+			}
+		}
+
+		err = rw.createFileAndFolderIfNeeded(false)
+		if err != nil {
+			return 0, err
+		}
+	}
+
+	rw.currentFileSize += int64(len(bytes))
+	return rw.currentFile.Write(bytes)
+}
+
+func (rw *rollingFileWriter) Close() error {
+	if rw.currentFile != nil {
+		e := rw.currentFile.Close()
+		if e != nil {
+			return e
+		}
+		rw.currentFile = nil
+	}
+	return nil
+}
+
+// =============================================================================================
+//      Different types of rolling writers
+// =============================================================================================
+
+// --------------------------------------------------
+//      Rolling writer by SIZE
+// --------------------------------------------------
+
+// rollingFileWriterSize performs roll when file exceeds a specified limit.
+type rollingFileWriterSize struct {
+	*rollingFileWriter
+	maxFileSize int64
+}
+
+func NewRollingFileWriterSize(fpath string, atype rollingArchiveType, apath string, maxSize int64, maxRolls int, namemode rollingNameMode) (*rollingFileWriterSize, error) {
+	rw, err := newRollingFileWriter(fpath, rollingTypeSize, atype, apath, maxRolls, namemode)
+	if err != nil {
+		return nil, err
+	}
+	rws := &rollingFileWriterSize{rw, maxSize}
+	rws.self = rws
+	return rws, nil
+}
+
+func (rws *rollingFileWriterSize) needsToRoll() (bool, error) {
+	return rws.currentFileSize >= rws.maxFileSize, nil
+}
+
+func (rws *rollingFileWriterSize) isFileRollNameValid(rname string) bool {
+	if len(rname) == 0 {
+		return false
+	}
+	_, err := strconv.Atoi(rname)
+	return err == nil
+}
+
+type rollSizeFileTailsSlice []string
+
+func (p rollSizeFileTailsSlice) Len() int { return len(p) }
+func (p rollSizeFileTailsSlice) Less(i, j int) bool {
+	v1, _ := strconv.Atoi(p[i])
+	v2, _ := strconv.Atoi(p[j])
+	return v1 < v2
+}
+func (p rollSizeFileTailsSlice) Swap(i, j int) { p[i], p[j] = p[j], p[i] }
+
+func (rws *rollingFileWriterSize) sortFileRollNamesAsc(fs []string) ([]string, error) {
+	ss := rollSizeFileTailsSlice(fs)
+	sort.Sort(ss)
+	return ss, nil
+}
+
+func (rws *rollingFileWriterSize) getNewHistoryRollFileName(lastRollName string) string {
+	v := 0
+	if len(lastRollName) != 0 {
+		v, _ = strconv.Atoi(lastRollName)
+	}
+	return fmt.Sprintf("%d", v+1)
+}
+
+func (rws *rollingFileWriterSize) getCurrentModifiedFileName(originalFileName string, first bool) (string, error) {
+	return originalFileName, nil
+}
+
+func (rws *rollingFileWriterSize) String() string {
+	return fmt.Sprintf("Rolling file writer (By SIZE): filename: %s, archive: %s, archivefile: %s, maxFileSize: %v, maxRolls: %v",
+		rws.fileName,
+		rollingArchiveTypesStringRepresentation[rws.archiveType],
+		rws.archivePath,
+		rws.maxFileSize,
+		rws.maxRolls)
+}
+
+// --------------------------------------------------
+//      Rolling writer by TIME
+// --------------------------------------------------
+
+// rollingFileWriterTime performs roll when a specified time interval has passed.
+type rollingFileWriterTime struct {
+	*rollingFileWriter
+	timePattern         string
+	interval            rollingIntervalType
+	currentTimeFileName string
+}
+
+func NewRollingFileWriterTime(fpath string, atype rollingArchiveType, apath string, maxr int,
+	timePattern string, interval rollingIntervalType, namemode rollingNameMode) (*rollingFileWriterTime, error) {
+
+	rw, err := newRollingFileWriter(fpath, rollingTypeTime, atype, apath, maxr, namemode)
+	if err != nil {
+		return nil, err
+	}
+	rws := &rollingFileWriterTime{rw, timePattern, interval, ""}
+	rws.self = rws
+	return rws, nil
+}
+
+func (rwt *rollingFileWriterTime) needsToRoll() (bool, error) {
+	switch rwt.nameMode {
+	case rollingNameModePostfix:
+		if rwt.originalFileName+rollingLogHistoryDelimiter+time.Now().Format(rwt.timePattern) == rwt.fileName {
+			return false, nil
+		}
+	case rollingNameModePrefix:
+		if time.Now().Format(rwt.timePattern)+rollingLogHistoryDelimiter+rwt.originalFileName == rwt.fileName {
+			return false, nil
+		}
+	}
+	if rwt.interval == rollingIntervalAny {
+		return true, nil
+	}
+
+	tprev, err := time.ParseInLocation(rwt.timePattern, rwt.getFileRollName(rwt.fileName), time.Local)
+	if err != nil {
+		return false, err
+	}
+
+	diff := time.Now().Sub(tprev)
+	switch rwt.interval {
+	case rollingIntervalDaily:
+		return diff >= 24*time.Hour, nil
+	}
+	return false, fmt.Errorf("unknown interval type: %d", rwt.interval)
+}
+
+func (rwt *rollingFileWriterTime) isFileRollNameValid(rname string) bool {
+	if len(rname) == 0 {
+		return false
+	}
+	_, err := time.ParseInLocation(rwt.timePattern, rname, time.Local)
+	return err == nil
+}
+
+type rollTimeFileTailsSlice struct {
+	data    []string
+	pattern string
+}
+
+func (p rollTimeFileTailsSlice) Len() int { return len(p.data) }
+
+func (p rollTimeFileTailsSlice) Less(i, j int) bool {
+	t1, _ := time.ParseInLocation(p.pattern, p.data[i], time.Local)
+	t2, _ := time.ParseInLocation(p.pattern, p.data[j], time.Local)
+	return t1.Before(t2)
+}
+
+func (p rollTimeFileTailsSlice) Swap(i, j int) { p.data[i], p.data[j] = p.data[j], p.data[i] }
+
+func (rwt *rollingFileWriterTime) sortFileRollNamesAsc(fs []string) ([]string, error) {
+	ss := rollTimeFileTailsSlice{data: fs, pattern: rwt.timePattern}
+	sort.Sort(ss)
+	return ss.data, nil
+}
+
+func (rwt *rollingFileWriterTime) getNewHistoryRollFileName(lastRollName string) string {
+	return ""
+}
+
+func (rwt *rollingFileWriterTime) getCurrentModifiedFileName(originalFileName string, first bool) (string, error) {
+	if first {
+		history, err := rwt.getSortedLogHistory()
+		if err != nil {
+			return "", err
+		}
+		if len(history) > 0 {
+			return history[len(history)-1], nil
+		}
+	}
+
+	switch rwt.nameMode {
+	case rollingNameModePostfix:
+		return originalFileName + rollingLogHistoryDelimiter + time.Now().Format(rwt.timePattern), nil
+	case rollingNameModePrefix:
+		return time.Now().Format(rwt.timePattern) + rollingLogHistoryDelimiter + originalFileName, nil
+	}
+	return "", fmt.Errorf("Unknown rolling writer mode. Either postfix or prefix must be used")
+}
+
+func (rwt *rollingFileWriterTime) String() string {
+	return fmt.Sprintf("Rolling file writer (By TIME): filename: %s, archive: %s, archivefile: %s, maxInterval: %v, pattern: %s, maxRolls: %v",
+		rwt.fileName,
+		rollingArchiveTypesStringRepresentation[rwt.archiveType],
+		rwt.archivePath,
+		rwt.interval,
+		rwt.timePattern,
+		rwt.maxRolls)
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/writers_smtpwriter.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/writers_smtpwriter.go
new file mode 100644
index 00000000..31b79438
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/cihub/seelog/writers_smtpwriter.go
@@ -0,0 +1,214 @@
+// Copyright (c) 2012 - Cloud Instruments Co., Ltd.
+//
+// All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are met:
+//
+// 1. Redistributions of source code must retain the above copyright notice, this
+//    list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright notice,
+//    this list of conditions and the following disclaimer in the documentation
+//    and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+// ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+// ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+// ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+package seelog
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"io/ioutil"
+	"net/smtp"
+	"path/filepath"
+	"strings"
+)
+
+const (
+	// Default subject phrase for sending emails.
+	DefaultSubjectPhrase = "Diagnostic message from server: "
+
+	// Message subject pattern composed according to RFC 5321.
+	rfc5321SubjectPattern = "From: %s <%s>\nSubject: %s\n\n"
+)
+
+// smtpWriter is used to send emails via given SMTP-server.
+type smtpWriter struct {
+	auth               smtp.Auth
+	hostName           string
+	hostPort           string
+	hostNameWithPort   string
+	senderAddress      string
+	senderName         string
+	recipientAddresses []string
+	caCertDirPaths     []string
+	mailHeaders        []string
+	subject            string
+}
+
+// NewSMTPWriter returns a new SMTP-writer.
+func NewSMTPWriter(sa, sn string, ras []string, hn, hp, un, pwd string, cacdps []string, subj string, headers []string) *smtpWriter {
+	return &smtpWriter{
+		auth:               smtp.PlainAuth("", un, pwd, hn),
+		hostName:           hn,
+		hostPort:           hp,
+		hostNameWithPort:   fmt.Sprintf("%s:%s", hn, hp),
+		senderAddress:      sa,
+		senderName:         sn,
+		recipientAddresses: ras,
+		caCertDirPaths:     cacdps,
+		subject:            subj,
+		mailHeaders:        headers,
+	}
+}
+
+func prepareMessage(senderAddr, senderName, subject string, body []byte, headers []string) []byte {
+	headerLines := fmt.Sprintf(rfc5321SubjectPattern, senderName, senderAddr, subject)
+	// Build header lines if configured.
+	if headers != nil && len(headers) > 0 {
+		headerLines += strings.Join(headers, "\n")
+		headerLines += "\n"
+	}
+	return append([]byte(headerLines), body...)
+}
+
+// getTLSConfig gets paths of PEM files with certificates,
+// host server name and tries to create an appropriate TLS.Config.
+func getTLSConfig(pemFileDirPaths []string, hostName string) (config *tls.Config, err error) {
+	if pemFileDirPaths == nil || len(pemFileDirPaths) == 0 {
+		err = errors.New("invalid PEM file paths")
+		return
+	}
+	pemEncodedContent := []byte{}
+	var (
+		e     error
+		bytes []byte
+	)
+	// Create a file-filter-by-extension, set aside non-pem files.
+	pemFilePathFilter := func(fp string) bool {
+		if filepath.Ext(fp) == ".pem" {
+			return true
+		}
+		return false
+	}
+	for _, pemFileDirPath := range pemFileDirPaths {
+		pemFilePaths, err := getDirFilePaths(pemFileDirPath, pemFilePathFilter, false)
+		if err != nil {
+			return nil, err
+		}
+
+		// Put together all the PEM files to decode them as a whole byte slice.
+		for _, pfp := range pemFilePaths {
+			if bytes, e = ioutil.ReadFile(pfp); e == nil {
+				pemEncodedContent = append(pemEncodedContent, bytes...)
+			} else {
+				return nil, fmt.Errorf("cannot read file: %s: %s", pfp, e.Error())
+			}
+		}
+	}
+	config = &tls.Config{RootCAs: x509.NewCertPool(), ServerName: hostName}
+	isAppended := config.RootCAs.AppendCertsFromPEM(pemEncodedContent)
+	if !isAppended {
+		// Extract this into a separate error.
+		err = errors.New("invalid PEM content")
+		return
+	}
+	return
+}
+
+// SendMail accepts TLS configuration, connects to the server at addr,
+// switches to TLS if possible, authenticates with mechanism a if possible,
+// and then sends an email from address from, to addresses to, with message msg.
+func sendMailWithTLSConfig(config *tls.Config, addr string, a smtp.Auth, from string, to []string, msg []byte) error {
+	c, err := smtp.Dial(addr)
+	if err != nil {
+		return err
+	}
+	// Check if the server supports STARTTLS extension.
+	if ok, _ := c.Extension("STARTTLS"); ok {
+		if err = c.StartTLS(config); err != nil {
+			return err
+		}
+	}
+	// Check if the server supports AUTH extension and use given smtp.Auth.
+	if a != nil {
+		if isSupported, _ := c.Extension("AUTH"); isSupported {
+			if err = c.Auth(a); err != nil {
+				return err
+			}
+		}
+	}
+	// Portion of code from the official smtp.SendMail function,
+	// see http://golang.org/src/pkg/net/smtp/smtp.go.
+	if err = c.Mail(from); err != nil {
+		return err
+	}
+	for _, addr := range to {
+		if err = c.Rcpt(addr); err != nil {
+			return err
+		}
+	}
+	w, err := c.Data()
+	if err != nil {
+		return err
+	}
+	_, err = w.Write(msg)
+	if err != nil {
+		return err
+	}
+	err = w.Close()
+	if err != nil {
+		return err
+	}
+	return c.Quit()
+}
+
+// Write pushes a text message properly composed according to RFC 5321
+// to a post server, which sends it to the recipients.
+func (smtpw *smtpWriter) Write(data []byte) (int, error) {
+	var err error
+
+	if smtpw.caCertDirPaths == nil {
+		err = smtp.SendMail(
+			smtpw.hostNameWithPort,
+			smtpw.auth,
+			smtpw.senderAddress,
+			smtpw.recipientAddresses,
+			prepareMessage(smtpw.senderAddress, smtpw.senderName, smtpw.subject, data, smtpw.mailHeaders),
+		)
+	} else {
+		config, e := getTLSConfig(smtpw.caCertDirPaths, smtpw.hostName)
+		if e != nil {
+			return 0, e
+		}
+		err = sendMailWithTLSConfig(
+			config,
+			smtpw.hostNameWithPort,
+			smtpw.auth,
+			smtpw.senderAddress,
+			smtpw.recipientAddresses,
+			prepareMessage(smtpw.senderAddress, smtpw.senderName, smtpw.subject, data, smtpw.mailHeaders),
+		)
+	}
+	if err != nil {
+		return 0, err
+	}
+	return len(data), nil
+}
+
+// Close closes down SMTP-connection.
+func (smtpw *smtpWriter) Close() error {
+	// Do nothing as Write method opens and closes connection automatically.
+	return nil
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/.gitignore b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/.gitignore
new file mode 100644
index 00000000..5091fb07
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/.gitignore
@@ -0,0 +1,4 @@
+/jpgo
+jmespath-fuzz.zip
+cpu.out
+go-jmespath.test
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/.travis.yml b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/.travis.yml
new file mode 100644
index 00000000..1f980775
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/.travis.yml
@@ -0,0 +1,9 @@
+language: go
+
+sudo: false
+
+go:
+  - 1.4
+
+install: go get -v -t ./...
+script: make test
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/LICENSE b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/LICENSE
new file mode 100644
index 00000000..b03310a9
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/LICENSE
@@ -0,0 +1,13 @@
+Copyright 2015 James Saryerwinnie
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/Makefile b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/Makefile
new file mode 100644
index 00000000..a828d284
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/Makefile
@@ -0,0 +1,44 @@
+
+CMD = jpgo
+
+help:
+	@echo "Please use \`make <target>' where <target> is one of"
+	@echo "  test                    to run all the tests"
+	@echo "  build                   to build the library and jp executable"
+	@echo "  generate                to run codegen"
+
+
+generate:
+	go generate ./...
+
+build:
+	rm -f $(CMD)
+	go build ./...
+	rm -f cmd/$(CMD)/$(CMD) && cd cmd/$(CMD)/ && go build ./...
+	mv cmd/$(CMD)/$(CMD) .
+
+test:
+	go test -v ./...
+
+check:
+	go vet ./...
+	@echo "golint ./..."
+	@lint=`golint ./...`; \
+	lint=`echo "$$lint" | grep -v "astnodetype_string.go" | grep -v "toktype_string.go"`; \
+	echo "$$lint"; \
+	if [ "$$lint" != "" ]; then exit 1; fi
+
+htmlc:
+	go test -coverprofile="/tmp/jpcov"  && go tool cover -html="/tmp/jpcov" && unlink /tmp/jpcov
+
+buildfuzz:
+	go-fuzz-build github.com/jmespath/go-jmespath/fuzz
+
+fuzz: buildfuzz
+	go-fuzz -bin=./jmespath-fuzz.zip -workdir=fuzz/testdata
+
+bench:
+	go test -bench . -cpuprofile cpu.out
+
+pprof-cpu:
+	go tool pprof ./go-jmespath.test ./cpu.out
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/README.md b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/README.md
new file mode 100644
index 00000000..187ef676
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/README.md
@@ -0,0 +1,7 @@
+# go-jmespath - A JMESPath implementation in Go
+
+[![Build Status](https://img.shields.io/travis/jmespath/go-jmespath.svg)](https://travis-ci.org/jmespath/go-jmespath)
+
+
+
+See http://jmespath.org for more info.
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/api.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/api.go
new file mode 100644
index 00000000..8e26ffee
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/api.go
@@ -0,0 +1,49 @@
+package jmespath
+
+import "strconv"
+
+// JMESPath is the epresentation of a compiled JMES path query. A JMESPath is
+// safe for concurrent use by multiple goroutines.
+type JMESPath struct {
+	ast  ASTNode
+	intr *treeInterpreter
+}
+
+// Compile parses a JMESPath expression and returns, if successful, a JMESPath
+// object that can be used to match against data.
+func Compile(expression string) (*JMESPath, error) {
+	parser := NewParser()
+	ast, err := parser.Parse(expression)
+	if err != nil {
+		return nil, err
+	}
+	jmespath := &JMESPath{ast: ast, intr: newInterpreter()}
+	return jmespath, nil
+}
+
+// MustCompile is like Compile but panics if the expression cannot be parsed.
+// It simplifies safe initialization of global variables holding compiled
+// JMESPaths.
+func MustCompile(expression string) *JMESPath {
+	jmespath, err := Compile(expression)
+	if err != nil {
+		panic(`jmespath: Compile(` + strconv.Quote(expression) + `): ` + err.Error())
+	}
+	return jmespath
+}
+
+// Search evaluates a JMESPath expression against input data and returns the result.
+func (jp *JMESPath) Search(data interface{}) (interface{}, error) {
+	return jp.intr.Execute(jp.ast, data)
+}
+
+// Search evaluates a JMESPath expression against input data and returns the result.
+func Search(expression string, data interface{}) (interface{}, error) {
+	intr := newInterpreter()
+	parser := NewParser()
+	ast, err := parser.Parse(expression)
+	if err != nil {
+		return nil, err
+	}
+	return intr.Execute(ast, data)
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/astnodetype_string.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/astnodetype_string.go
new file mode 100644
index 00000000..1cd2d239
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/astnodetype_string.go
@@ -0,0 +1,16 @@
+// generated by stringer -type astNodeType; DO NOT EDIT
+
+package jmespath
+
+import "fmt"
+
+const _astNodeType_name = "ASTEmptyASTComparatorASTCurrentNodeASTExpRefASTFunctionExpressionASTFieldASTFilterProjectionASTFlattenASTIdentityASTIndexASTIndexExpressionASTKeyValPairASTLiteralASTMultiSelectHashASTMultiSelectListASTOrExpressionASTAndExpressionASTNotExpressionASTPipeASTProjectionASTSubexpressionASTSliceASTValueProjection"
+
+var _astNodeType_index = [...]uint16{0, 8, 21, 35, 44, 65, 73, 92, 102, 113, 121, 139, 152, 162, 180, 198, 213, 229, 245, 252, 265, 281, 289, 307}
+
+func (i astNodeType) String() string {
+	if i < 0 || i >= astNodeType(len(_astNodeType_index)-1) {
+		return fmt.Sprintf("astNodeType(%d)", i)
+	}
+	return _astNodeType_name[_astNodeType_index[i]:_astNodeType_index[i+1]]
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/functions.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/functions.go
new file mode 100644
index 00000000..9b7cd89b
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/functions.go
@@ -0,0 +1,842 @@
+package jmespath
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"math"
+	"reflect"
+	"sort"
+	"strconv"
+	"strings"
+	"unicode/utf8"
+)
+
+type jpFunction func(arguments []interface{}) (interface{}, error)
+
+type jpType string
+
+const (
+	jpUnknown     jpType = "unknown"
+	jpNumber      jpType = "number"
+	jpString      jpType = "string"
+	jpArray       jpType = "array"
+	jpObject      jpType = "object"
+	jpArrayNumber jpType = "array[number]"
+	jpArrayString jpType = "array[string]"
+	jpExpref      jpType = "expref"
+	jpAny         jpType = "any"
+)
+
+type functionEntry struct {
+	name      string
+	arguments []argSpec
+	handler   jpFunction
+	hasExpRef bool
+}
+
+type argSpec struct {
+	types    []jpType
+	variadic bool
+}
+
+type byExprString struct {
+	intr     *treeInterpreter
+	node     ASTNode
+	items    []interface{}
+	hasError bool
+}
+
+func (a *byExprString) Len() int {
+	return len(a.items)
+}
+func (a *byExprString) Swap(i, j int) {
+	a.items[i], a.items[j] = a.items[j], a.items[i]
+}
+func (a *byExprString) Less(i, j int) bool {
+	first, err := a.intr.Execute(a.node, a.items[i])
+	if err != nil {
+		a.hasError = true
+		// Return a dummy value.
+		return true
+	}
+	ith, ok := first.(string)
+	if !ok {
+		a.hasError = true
+		return true
+	}
+	second, err := a.intr.Execute(a.node, a.items[j])
+	if err != nil {
+		a.hasError = true
+		// Return a dummy value.
+		return true
+	}
+	jth, ok := second.(string)
+	if !ok {
+		a.hasError = true
+		return true
+	}
+	return ith < jth
+}
+
+type byExprFloat struct {
+	intr     *treeInterpreter
+	node     ASTNode
+	items    []interface{}
+	hasError bool
+}
+
+func (a *byExprFloat) Len() int {
+	return len(a.items)
+}
+func (a *byExprFloat) Swap(i, j int) {
+	a.items[i], a.items[j] = a.items[j], a.items[i]
+}
+func (a *byExprFloat) Less(i, j int) bool {
+	first, err := a.intr.Execute(a.node, a.items[i])
+	if err != nil {
+		a.hasError = true
+		// Return a dummy value.
+		return true
+	}
+	ith, ok := first.(float64)
+	if !ok {
+		a.hasError = true
+		return true
+	}
+	second, err := a.intr.Execute(a.node, a.items[j])
+	if err != nil {
+		a.hasError = true
+		// Return a dummy value.
+		return true
+	}
+	jth, ok := second.(float64)
+	if !ok {
+		a.hasError = true
+		return true
+	}
+	return ith < jth
+}
+
+type functionCaller struct {
+	functionTable map[string]functionEntry
+}
+
+func newFunctionCaller() *functionCaller {
+	caller := &functionCaller{}
+	caller.functionTable = map[string]functionEntry{
+		"length": {
+			name: "length",
+			arguments: []argSpec{
+				{types: []jpType{jpString, jpArray, jpObject}},
+			},
+			handler: jpfLength,
+		},
+		"starts_with": {
+			name: "starts_with",
+			arguments: []argSpec{
+				{types: []jpType{jpString}},
+				{types: []jpType{jpString}},
+			},
+			handler: jpfStartsWith,
+		},
+		"abs": {
+			name: "abs",
+			arguments: []argSpec{
+				{types: []jpType{jpNumber}},
+			},
+			handler: jpfAbs,
+		},
+		"avg": {
+			name: "avg",
+			arguments: []argSpec{
+				{types: []jpType{jpArrayNumber}},
+			},
+			handler: jpfAvg,
+		},
+		"ceil": {
+			name: "ceil",
+			arguments: []argSpec{
+				{types: []jpType{jpNumber}},
+			},
+			handler: jpfCeil,
+		},
+		"contains": {
+			name: "contains",
+			arguments: []argSpec{
+				{types: []jpType{jpArray, jpString}},
+				{types: []jpType{jpAny}},
+			},
+			handler: jpfContains,
+		},
+		"ends_with": {
+			name: "ends_with",
+			arguments: []argSpec{
+				{types: []jpType{jpString}},
+				{types: []jpType{jpString}},
+			},
+			handler: jpfEndsWith,
+		},
+		"floor": {
+			name: "floor",
+			arguments: []argSpec{
+				{types: []jpType{jpNumber}},
+			},
+			handler: jpfFloor,
+		},
+		"map": {
+			name: "amp",
+			arguments: []argSpec{
+				{types: []jpType{jpExpref}},
+				{types: []jpType{jpArray}},
+			},
+			handler:   jpfMap,
+			hasExpRef: true,
+		},
+		"max": {
+			name: "max",
+			arguments: []argSpec{
+				{types: []jpType{jpArrayNumber, jpArrayString}},
+			},
+			handler: jpfMax,
+		},
+		"merge": {
+			name: "merge",
+			arguments: []argSpec{
+				{types: []jpType{jpObject}, variadic: true},
+			},
+			handler: jpfMerge,
+		},
+		"max_by": {
+			name: "max_by",
+			arguments: []argSpec{
+				{types: []jpType{jpArray}},
+				{types: []jpType{jpExpref}},
+			},
+			handler:   jpfMaxBy,
+			hasExpRef: true,
+		},
+		"sum": {
+			name: "sum",
+			arguments: []argSpec{
+				{types: []jpType{jpArrayNumber}},
+			},
+			handler: jpfSum,
+		},
+		"min": {
+			name: "min",
+			arguments: []argSpec{
+				{types: []jpType{jpArrayNumber, jpArrayString}},
+			},
+			handler: jpfMin,
+		},
+		"min_by": {
+			name: "min_by",
+			arguments: []argSpec{
+				{types: []jpType{jpArray}},
+				{types: []jpType{jpExpref}},
+			},
+			handler:   jpfMinBy,
+			hasExpRef: true,
+		},
+		"type": {
+			name: "type",
+			arguments: []argSpec{
+				{types: []jpType{jpAny}},
+			},
+			handler: jpfType,
+		},
+		"keys": {
+			name: "keys",
+			arguments: []argSpec{
+				{types: []jpType{jpObject}},
+			},
+			handler: jpfKeys,
+		},
+		"values": {
+			name: "values",
+			arguments: []argSpec{
+				{types: []jpType{jpObject}},
+			},
+			handler: jpfValues,
+		},
+		"sort": {
+			name: "sort",
+			arguments: []argSpec{
+				{types: []jpType{jpArrayString, jpArrayNumber}},
+			},
+			handler: jpfSort,
+		},
+		"sort_by": {
+			name: "sort_by",
+			arguments: []argSpec{
+				{types: []jpType{jpArray}},
+				{types: []jpType{jpExpref}},
+			},
+			handler:   jpfSortBy,
+			hasExpRef: true,
+		},
+		"join": {
+			name: "join",
+			arguments: []argSpec{
+				{types: []jpType{jpString}},
+				{types: []jpType{jpArrayString}},
+			},
+			handler: jpfJoin,
+		},
+		"reverse": {
+			name: "reverse",
+			arguments: []argSpec{
+				{types: []jpType{jpArray, jpString}},
+			},
+			handler: jpfReverse,
+		},
+		"to_array": {
+			name: "to_array",
+			arguments: []argSpec{
+				{types: []jpType{jpAny}},
+			},
+			handler: jpfToArray,
+		},
+		"to_string": {
+			name: "to_string",
+			arguments: []argSpec{
+				{types: []jpType{jpAny}},
+			},
+			handler: jpfToString,
+		},
+		"to_number": {
+			name: "to_number",
+			arguments: []argSpec{
+				{types: []jpType{jpAny}},
+			},
+			handler: jpfToNumber,
+		},
+		"not_null": {
+			name: "not_null",
+			arguments: []argSpec{
+				{types: []jpType{jpAny}, variadic: true},
+			},
+			handler: jpfNotNull,
+		},
+	}
+	return caller
+}
+
+func (e *functionEntry) resolveArgs(arguments []interface{}) ([]interface{}, error) {
+	if len(e.arguments) == 0 {
+		return arguments, nil
+	}
+	if !e.arguments[len(e.arguments)-1].variadic {
+		if len(e.arguments) != len(arguments) {
+			return nil, errors.New("incorrect number of args")
+		}
+		for i, spec := range e.arguments {
+			userArg := arguments[i]
+			err := spec.typeCheck(userArg)
+			if err != nil {
+				return nil, err
+			}
+		}
+		return arguments, nil
+	}
+	if len(arguments) < len(e.arguments) {
+		return nil, errors.New("Invalid arity.")
+	}
+	return arguments, nil
+}
+
+func (a *argSpec) typeCheck(arg interface{}) error {
+	for _, t := range a.types {
+		switch t {
+		case jpNumber:
+			if _, ok := arg.(float64); ok {
+				return nil
+			}
+		case jpString:
+			if _, ok := arg.(string); ok {
+				return nil
+			}
+		case jpArray:
+			if isSliceType(arg) {
+				return nil
+			}
+		case jpObject:
+			if _, ok := arg.(map[string]interface{}); ok {
+				return nil
+			}
+		case jpArrayNumber:
+			if _, ok := toArrayNum(arg); ok {
+				return nil
+			}
+		case jpArrayString:
+			if _, ok := toArrayStr(arg); ok {
+				return nil
+			}
+		case jpAny:
+			return nil
+		case jpExpref:
+			if _, ok := arg.(expRef); ok {
+				return nil
+			}
+		}
+	}
+	return fmt.Errorf("Invalid type for: %v, expected: %#v", arg, a.types)
+}
+
+func (f *functionCaller) CallFunction(name string, arguments []interface{}, intr *treeInterpreter) (interface{}, error) {
+	entry, ok := f.functionTable[name]
+	if !ok {
+		return nil, errors.New("unknown function: " + name)
+	}
+	resolvedArgs, err := entry.resolveArgs(arguments)
+	if err != nil {
+		return nil, err
+	}
+	if entry.hasExpRef {
+		var extra []interface{}
+		extra = append(extra, intr)
+		resolvedArgs = append(extra, resolvedArgs...)
+	}
+	return entry.handler(resolvedArgs)
+}
+
+func jpfAbs(arguments []interface{}) (interface{}, error) {
+	num := arguments[0].(float64)
+	return math.Abs(num), nil
+}
+
+func jpfLength(arguments []interface{}) (interface{}, error) {
+	arg := arguments[0]
+	if c, ok := arg.(string); ok {
+		return float64(utf8.RuneCountInString(c)), nil
+	} else if isSliceType(arg) {
+		v := reflect.ValueOf(arg)
+		return float64(v.Len()), nil
+	} else if c, ok := arg.(map[string]interface{}); ok {
+		return float64(len(c)), nil
+	}
+	return nil, errors.New("could not compute length()")
+}
+
+func jpfStartsWith(arguments []interface{}) (interface{}, error) {
+	search := arguments[0].(string)
+	prefix := arguments[1].(string)
+	return strings.HasPrefix(search, prefix), nil
+}
+
+func jpfAvg(arguments []interface{}) (interface{}, error) {
+	// We've already type checked the value so we can safely use
+	// type assertions.
+	args := arguments[0].([]interface{})
+	length := float64(len(args))
+	numerator := 0.0
+	for _, n := range args {
+		numerator += n.(float64)
+	}
+	return numerator / length, nil
+}
+func jpfCeil(arguments []interface{}) (interface{}, error) {
+	val := arguments[0].(float64)
+	return math.Ceil(val), nil
+}
+func jpfContains(arguments []interface{}) (interface{}, error) {
+	search := arguments[0]
+	el := arguments[1]
+	if searchStr, ok := search.(string); ok {
+		if elStr, ok := el.(string); ok {
+			return strings.Index(searchStr, elStr) != -1, nil
+		}
+		return false, nil
+	}
+	// Otherwise this is a generic contains for []interface{}
+	general := search.([]interface{})
+	for _, item := range general {
+		if item == el {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+func jpfEndsWith(arguments []interface{}) (interface{}, error) {
+	search := arguments[0].(string)
+	suffix := arguments[1].(string)
+	return strings.HasSuffix(search, suffix), nil
+}
+func jpfFloor(arguments []interface{}) (interface{}, error) {
+	val := arguments[0].(float64)
+	return math.Floor(val), nil
+}
+func jpfMap(arguments []interface{}) (interface{}, error) {
+	intr := arguments[0].(*treeInterpreter)
+	exp := arguments[1].(expRef)
+	node := exp.ref
+	arr := arguments[2].([]interface{})
+	mapped := make([]interface{}, 0, len(arr))
+	for _, value := range arr {
+		current, err := intr.Execute(node, value)
+		if err != nil {
+			return nil, err
+		}
+		mapped = append(mapped, current)
+	}
+	return mapped, nil
+}
+func jpfMax(arguments []interface{}) (interface{}, error) {
+	if items, ok := toArrayNum(arguments[0]); ok {
+		if len(items) == 0 {
+			return nil, nil
+		}
+		if len(items) == 1 {
+			return items[0], nil
+		}
+		best := items[0]
+		for _, item := range items[1:] {
+			if item > best {
+				best = item
+			}
+		}
+		return best, nil
+	}
+	// Otherwise we're dealing with a max() of strings.
+	items, _ := toArrayStr(arguments[0])
+	if len(items) == 0 {
+		return nil, nil
+	}
+	if len(items) == 1 {
+		return items[0], nil
+	}
+	best := items[0]
+	for _, item := range items[1:] {
+		if item > best {
+			best = item
+		}
+	}
+	return best, nil
+}
+func jpfMerge(arguments []interface{}) (interface{}, error) {
+	final := make(map[string]interface{})
+	for _, m := range arguments {
+		mapped := m.(map[string]interface{})
+		for key, value := range mapped {
+			final[key] = value
+		}
+	}
+	return final, nil
+}
+func jpfMaxBy(arguments []interface{}) (interface{}, error) {
+	intr := arguments[0].(*treeInterpreter)
+	arr := arguments[1].([]interface{})
+	exp := arguments[2].(expRef)
+	node := exp.ref
+	if len(arr) == 0 {
+		return nil, nil
+	} else if len(arr) == 1 {
+		return arr[0], nil
+	}
+	start, err := intr.Execute(node, arr[0])
+	if err != nil {
+		return nil, err
+	}
+	switch t := start.(type) {
+	case float64:
+		bestVal := t
+		bestItem := arr[0]
+		for _, item := range arr[1:] {
+			result, err := intr.Execute(node, item)
+			if err != nil {
+				return nil, err
+			}
+			current, ok := result.(float64)
+			if !ok {
+				return nil, errors.New("invalid type, must be number")
+			}
+			if current > bestVal {
+				bestVal = current
+				bestItem = item
+			}
+		}
+		return bestItem, nil
+	case string:
+		bestVal := t
+		bestItem := arr[0]
+		for _, item := range arr[1:] {
+			result, err := intr.Execute(node, item)
+			if err != nil {
+				return nil, err
+			}
+			current, ok := result.(string)
+			if !ok {
+				return nil, errors.New("invalid type, must be string")
+			}
+			if current > bestVal {
+				bestVal = current
+				bestItem = item
+			}
+		}
+		return bestItem, nil
+	default:
+		return nil, errors.New("invalid type, must be number of string")
+	}
+}
+func jpfSum(arguments []interface{}) (interface{}, error) {
+	items, _ := toArrayNum(arguments[0])
+	sum := 0.0
+	for _, item := range items {
+		sum += item
+	}
+	return sum, nil
+}
+
+func jpfMin(arguments []interface{}) (interface{}, error) {
+	if items, ok := toArrayNum(arguments[0]); ok {
+		if len(items) == 0 {
+			return nil, nil
+		}
+		if len(items) == 1 {
+			return items[0], nil
+		}
+		best := items[0]
+		for _, item := range items[1:] {
+			if item < best {
+				best = item
+			}
+		}
+		return best, nil
+	}
+	items, _ := toArrayStr(arguments[0])
+	if len(items) == 0 {
+		return nil, nil
+	}
+	if len(items) == 1 {
+		return items[0], nil
+	}
+	best := items[0]
+	for _, item := range items[1:] {
+		if item < best {
+			best = item
+		}
+	}
+	return best, nil
+}
+
+func jpfMinBy(arguments []interface{}) (interface{}, error) {
+	intr := arguments[0].(*treeInterpreter)
+	arr := arguments[1].([]interface{})
+	exp := arguments[2].(expRef)
+	node := exp.ref
+	if len(arr) == 0 {
+		return nil, nil
+	} else if len(arr) == 1 {
+		return arr[0], nil
+	}
+	start, err := intr.Execute(node, arr[0])
+	if err != nil {
+		return nil, err
+	}
+	if t, ok := start.(float64); ok {
+		bestVal := t
+		bestItem := arr[0]
+		for _, item := range arr[1:] {
+			result, err := intr.Execute(node, item)
+			if err != nil {
+				return nil, err
+			}
+			current, ok := result.(float64)
+			if !ok {
+				return nil, errors.New("invalid type, must be number")
+			}
+			if current < bestVal {
+				bestVal = current
+				bestItem = item
+			}
+		}
+		return bestItem, nil
+	} else if t, ok := start.(string); ok {
+		bestVal := t
+		bestItem := arr[0]
+		for _, item := range arr[1:] {
+			result, err := intr.Execute(node, item)
+			if err != nil {
+				return nil, err
+			}
+			current, ok := result.(string)
+			if !ok {
+				return nil, errors.New("invalid type, must be string")
+			}
+			if current < bestVal {
+				bestVal = current
+				bestItem = item
+			}
+		}
+		return bestItem, nil
+	} else {
+		return nil, errors.New("invalid type, must be number of string")
+	}
+}
+func jpfType(arguments []interface{}) (interface{}, error) {
+	arg := arguments[0]
+	if _, ok := arg.(float64); ok {
+		return "number", nil
+	}
+	if _, ok := arg.(string); ok {
+		return "string", nil
+	}
+	if _, ok := arg.([]interface{}); ok {
+		return "array", nil
+	}
+	if _, ok := arg.(map[string]interface{}); ok {
+		return "object", nil
+	}
+	if arg == nil {
+		return "null", nil
+	}
+	if arg == true || arg == false {
+		return "boolean", nil
+	}
+	return nil, errors.New("unknown type")
+}
+func jpfKeys(arguments []interface{}) (interface{}, error) {
+	arg := arguments[0].(map[string]interface{})
+	collected := make([]interface{}, 0, len(arg))
+	for key := range arg {
+		collected = append(collected, key)
+	}
+	return collected, nil
+}
+func jpfValues(arguments []interface{}) (interface{}, error) {
+	arg := arguments[0].(map[string]interface{})
+	collected := make([]interface{}, 0, len(arg))
+	for _, value := range arg {
+		collected = append(collected, value)
+	}
+	return collected, nil
+}
+func jpfSort(arguments []interface{}) (interface{}, error) {
+	if items, ok := toArrayNum(arguments[0]); ok {
+		d := sort.Float64Slice(items)
+		sort.Stable(d)
+		final := make([]interface{}, len(d))
+		for i, val := range d {
+			final[i] = val
+		}
+		return final, nil
+	}
+	// Otherwise we're dealing with sort()'ing strings.
+	items, _ := toArrayStr(arguments[0])
+	d := sort.StringSlice(items)
+	sort.Stable(d)
+	final := make([]interface{}, len(d))
+	for i, val := range d {
+		final[i] = val
+	}
+	return final, nil
+}
+func jpfSortBy(arguments []interface{}) (interface{}, error) {
+	intr := arguments[0].(*treeInterpreter)
+	arr := arguments[1].([]interface{})
+	exp := arguments[2].(expRef)
+	node := exp.ref
+	if len(arr) == 0 {
+		return arr, nil
+	} else if len(arr) == 1 {
+		return arr, nil
+	}
+	start, err := intr.Execute(node, arr[0])
+	if err != nil {
+		return nil, err
+	}
+	if _, ok := start.(float64); ok {
+		sortable := &byExprFloat{intr, node, arr, false}
+		sort.Stable(sortable)
+		if sortable.hasError {
+			return nil, errors.New("error in sort_by comparison")
+		}
+		return arr, nil
+	} else if _, ok := start.(string); ok {
+		sortable := &byExprString{intr, node, arr, false}
+		sort.Stable(sortable)
+		if sortable.hasError {
+			return nil, errors.New("error in sort_by comparison")
+		}
+		return arr, nil
+	} else {
+		return nil, errors.New("invalid type, must be number of string")
+	}
+}
+func jpfJoin(arguments []interface{}) (interface{}, error) {
+	sep := arguments[0].(string)
+	// We can't just do arguments[1].([]string), we have to
+	// manually convert each item to a string.
+	arrayStr := []string{}
+	for _, item := range arguments[1].([]interface{}) {
+		arrayStr = append(arrayStr, item.(string))
+	}
+	return strings.Join(arrayStr, sep), nil
+}
+func jpfReverse(arguments []interface{}) (interface{}, error) {
+	if s, ok := arguments[0].(string); ok {
+		r := []rune(s)
+		for i, j := 0, len(r)-1; i < len(r)/2; i, j = i+1, j-1 {
+			r[i], r[j] = r[j], r[i]
+		}
+		return string(r), nil
+	}
+	items := arguments[0].([]interface{})
+	length := len(items)
+	reversed := make([]interface{}, length)
+	for i, item := range items {
+		reversed[length-(i+1)] = item
+	}
+	return reversed, nil
+}
+func jpfToArray(arguments []interface{}) (interface{}, error) {
+	if _, ok := arguments[0].([]interface{}); ok {
+		return arguments[0], nil
+	}
+	return arguments[:1:1], nil
+}
+func jpfToString(arguments []interface{}) (interface{}, error) {
+	if v, ok := arguments[0].(string); ok {
+		return v, nil
+	}
+	result, err := json.Marshal(arguments[0])
+	if err != nil {
+		return nil, err
+	}
+	return string(result), nil
+}
+func jpfToNumber(arguments []interface{}) (interface{}, error) {
+	arg := arguments[0]
+	if v, ok := arg.(float64); ok {
+		return v, nil
+	}
+	if v, ok := arg.(string); ok {
+		conv, err := strconv.ParseFloat(v, 64)
+		if err != nil {
+			return nil, nil
+		}
+		return conv, nil
+	}
+	if _, ok := arg.([]interface{}); ok {
+		return nil, nil
+	}
+	if _, ok := arg.(map[string]interface{}); ok {
+		return nil, nil
+	}
+	if arg == nil {
+		return nil, nil
+	}
+	if arg == true || arg == false {
+		return nil, nil
+	}
+	return nil, errors.New("unknown type")
+}
+func jpfNotNull(arguments []interface{}) (interface{}, error) {
+	for _, arg := range arguments {
+		if arg != nil {
+			return arg, nil
+		}
+	}
+	return nil, nil
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/interpreter.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/interpreter.go
new file mode 100644
index 00000000..13c74604
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/interpreter.go
@@ -0,0 +1,418 @@
+package jmespath
+
+import (
+	"errors"
+	"reflect"
+	"unicode"
+	"unicode/utf8"
+)
+
+/* This is a tree based interpreter.  It walks the AST and directly
+   interprets the AST to search through a JSON document.
+*/
+
+type treeInterpreter struct {
+	fCall *functionCaller
+}
+
+func newInterpreter() *treeInterpreter {
+	interpreter := treeInterpreter{}
+	interpreter.fCall = newFunctionCaller()
+	return &interpreter
+}
+
+type expRef struct {
+	ref ASTNode
+}
+
+// Execute takes an ASTNode and input data and interprets the AST directly.
+// It will produce the result of applying the JMESPath expression associated
+// with the ASTNode to the input data "value".
+func (intr *treeInterpreter) Execute(node ASTNode, value interface{}) (interface{}, error) {
+	switch node.nodeType {
+	case ASTComparator:
+		left, err := intr.Execute(node.children[0], value)
+		if err != nil {
+			return nil, err
+		}
+		right, err := intr.Execute(node.children[1], value)
+		if err != nil {
+			return nil, err
+		}
+		switch node.value {
+		case tEQ:
+			return objsEqual(left, right), nil
+		case tNE:
+			return !objsEqual(left, right), nil
+		}
+		leftNum, ok := left.(float64)
+		if !ok {
+			return nil, nil
+		}
+		rightNum, ok := right.(float64)
+		if !ok {
+			return nil, nil
+		}
+		switch node.value {
+		case tGT:
+			return leftNum > rightNum, nil
+		case tGTE:
+			return leftNum >= rightNum, nil
+		case tLT:
+			return leftNum < rightNum, nil
+		case tLTE:
+			return leftNum <= rightNum, nil
+		}
+	case ASTExpRef:
+		return expRef{ref: node.children[0]}, nil
+	case ASTFunctionExpression:
+		resolvedArgs := []interface{}{}
+		for _, arg := range node.children {
+			current, err := intr.Execute(arg, value)
+			if err != nil {
+				return nil, err
+			}
+			resolvedArgs = append(resolvedArgs, current)
+		}
+		return intr.fCall.CallFunction(node.value.(string), resolvedArgs, intr)
+	case ASTField:
+		if m, ok := value.(map[string]interface{}); ok {
+			key := node.value.(string)
+			return m[key], nil
+		}
+		return intr.fieldFromStruct(node.value.(string), value)
+	case ASTFilterProjection:
+		left, err := intr.Execute(node.children[0], value)
+		if err != nil {
+			return nil, nil
+		}
+		sliceType, ok := left.([]interface{})
+		if !ok {
+			if isSliceType(left) {
+				return intr.filterProjectionWithReflection(node, left)
+			}
+			return nil, nil
+		}
+		compareNode := node.children[2]
+		collected := []interface{}{}
+		for _, element := range sliceType {
+			result, err := intr.Execute(compareNode, element)
+			if err != nil {
+				return nil, err
+			}
+			if !isFalse(result) {
+				current, err := intr.Execute(node.children[1], element)
+				if err != nil {
+					return nil, err
+				}
+				if current != nil {
+					collected = append(collected, current)
+				}
+			}
+		}
+		return collected, nil
+	case ASTFlatten:
+		left, err := intr.Execute(node.children[0], value)
+		if err != nil {
+			return nil, nil
+		}
+		sliceType, ok := left.([]interface{})
+		if !ok {
+			// If we can't type convert to []interface{}, there's
+			// a chance this could still work via reflection if we're
+			// dealing with user provided types.
+			if isSliceType(left) {
+				return intr.flattenWithReflection(left)
+			}
+			return nil, nil
+		}
+		flattened := []interface{}{}
+		for _, element := range sliceType {
+			if elementSlice, ok := element.([]interface{}); ok {
+				flattened = append(flattened, elementSlice...)
+			} else if isSliceType(element) {
+				reflectFlat := []interface{}{}
+				v := reflect.ValueOf(element)
+				for i := 0; i < v.Len(); i++ {
+					reflectFlat = append(reflectFlat, v.Index(i).Interface())
+				}
+				flattened = append(flattened, reflectFlat...)
+			} else {
+				flattened = append(flattened, element)
+			}
+		}
+		return flattened, nil
+	case ASTIdentity, ASTCurrentNode:
+		return value, nil
+	case ASTIndex:
+		if sliceType, ok := value.([]interface{}); ok {
+			index := node.value.(int)
+			if index < 0 {
+				index += len(sliceType)
+			}
+			if index < len(sliceType) && index >= 0 {
+				return sliceType[index], nil
+			}
+			return nil, nil
+		}
+		// Otherwise try via reflection.
+		rv := reflect.ValueOf(value)
+		if rv.Kind() == reflect.Slice {
+			index := node.value.(int)
+			if index < 0 {
+				index += rv.Len()
+			}
+			if index < rv.Len() && index >= 0 {
+				v := rv.Index(index)
+				return v.Interface(), nil
+			}
+		}
+		return nil, nil
+	case ASTKeyValPair:
+		return intr.Execute(node.children[0], value)
+	case ASTLiteral:
+		return node.value, nil
+	case ASTMultiSelectHash:
+		if value == nil {
+			return nil, nil
+		}
+		collected := make(map[string]interface{})
+		for _, child := range node.children {
+			current, err := intr.Execute(child, value)
+			if err != nil {
+				return nil, err
+			}
+			key := child.value.(string)
+			collected[key] = current
+		}
+		return collected, nil
+	case ASTMultiSelectList:
+		if value == nil {
+			return nil, nil
+		}
+		collected := []interface{}{}
+		for _, child := range node.children {
+			current, err := intr.Execute(child, value)
+			if err != nil {
+				return nil, err
+			}
+			collected = append(collected, current)
+		}
+		return collected, nil
+	case ASTOrExpression:
+		matched, err := intr.Execute(node.children[0], value)
+		if err != nil {
+			return nil, err
+		}
+		if isFalse(matched) {
+			matched, err = intr.Execute(node.children[1], value)
+			if err != nil {
+				return nil, err
+			}
+		}
+		return matched, nil
+	case ASTAndExpression:
+		matched, err := intr.Execute(node.children[0], value)
+		if err != nil {
+			return nil, err
+		}
+		if isFalse(matched) {
+			return matched, nil
+		}
+		return intr.Execute(node.children[1], value)
+	case ASTNotExpression:
+		matched, err := intr.Execute(node.children[0], value)
+		if err != nil {
+			return nil, err
+		}
+		if isFalse(matched) {
+			return true, nil
+		}
+		return false, nil
+	case ASTPipe:
+		result := value
+		var err error
+		for _, child := range node.children {
+			result, err = intr.Execute(child, result)
+			if err != nil {
+				return nil, err
+			}
+		}
+		return result, nil
+	case ASTProjection:
+		left, err := intr.Execute(node.children[0], value)
+		if err != nil {
+			return nil, err
+		}
+		sliceType, ok := left.([]interface{})
+		if !ok {
+			if isSliceType(left) {
+				return intr.projectWithReflection(node, left)
+			}
+			return nil, nil
+		}
+		collected := []interface{}{}
+		var current interface{}
+		for _, element := range sliceType {
+			current, err = intr.Execute(node.children[1], element)
+			if err != nil {
+				return nil, err
+			}
+			if current != nil {
+				collected = append(collected, current)
+			}
+		}
+		return collected, nil
+	case ASTSubexpression, ASTIndexExpression:
+		left, err := intr.Execute(node.children[0], value)
+		if err != nil {
+			return nil, err
+		}
+		return intr.Execute(node.children[1], left)
+	case ASTSlice:
+		sliceType, ok := value.([]interface{})
+		if !ok {
+			if isSliceType(value) {
+				return intr.sliceWithReflection(node, value)
+			}
+			return nil, nil
+		}
+		parts := node.value.([]*int)
+		sliceParams := make([]sliceParam, 3)
+		for i, part := range parts {
+			if part != nil {
+				sliceParams[i].Specified = true
+				sliceParams[i].N = *part
+			}
+		}
+		return slice(sliceType, sliceParams)
+	case ASTValueProjection:
+		left, err := intr.Execute(node.children[0], value)
+		if err != nil {
+			return nil, nil
+		}
+		mapType, ok := left.(map[string]interface{})
+		if !ok {
+			return nil, nil
+		}
+		values := make([]interface{}, len(mapType))
+		for _, value := range mapType {
+			values = append(values, value)
+		}
+		collected := []interface{}{}
+		for _, element := range values {
+			current, err := intr.Execute(node.children[1], element)
+			if err != nil {
+				return nil, err
+			}
+			if current != nil {
+				collected = append(collected, current)
+			}
+		}
+		return collected, nil
+	}
+	return nil, errors.New("Unknown AST node: " + node.nodeType.String())
+}
+
+func (intr *treeInterpreter) fieldFromStruct(key string, value interface{}) (interface{}, error) {
+	rv := reflect.ValueOf(value)
+	first, n := utf8.DecodeRuneInString(key)
+	fieldName := string(unicode.ToUpper(first)) + key[n:]
+	if rv.Kind() == reflect.Struct {
+		v := rv.FieldByName(fieldName)
+		if !v.IsValid() {
+			return nil, nil
+		}
+		return v.Interface(), nil
+	} else if rv.Kind() == reflect.Ptr {
+		// Handle multiple levels of indirection?
+		if rv.IsNil() {
+			return nil, nil
+		}
+		rv = rv.Elem()
+		v := rv.FieldByName(fieldName)
+		if !v.IsValid() {
+			return nil, nil
+		}
+		return v.Interface(), nil
+	}
+	return nil, nil
+}
+
+func (intr *treeInterpreter) flattenWithReflection(value interface{}) (interface{}, error) {
+	v := reflect.ValueOf(value)
+	flattened := []interface{}{}
+	for i := 0; i < v.Len(); i++ {
+		element := v.Index(i).Interface()
+		if reflect.TypeOf(element).Kind() == reflect.Slice {
+			// Then insert the contents of the element
+			// slice into the flattened slice,
+			// i.e flattened = append(flattened, mySlice...)
+			elementV := reflect.ValueOf(element)
+			for j := 0; j < elementV.Len(); j++ {
+				flattened = append(
+					flattened, elementV.Index(j).Interface())
+			}
+		} else {
+			flattened = append(flattened, element)
+		}
+	}
+	return flattened, nil
+}
+
+func (intr *treeInterpreter) sliceWithReflection(node ASTNode, value interface{}) (interface{}, error) {
+	v := reflect.ValueOf(value)
+	parts := node.value.([]*int)
+	sliceParams := make([]sliceParam, 3)
+	for i, part := range parts {
+		if part != nil {
+			sliceParams[i].Specified = true
+			sliceParams[i].N = *part
+		}
+	}
+	final := []interface{}{}
+	for i := 0; i < v.Len(); i++ {
+		element := v.Index(i).Interface()
+		final = append(final, element)
+	}
+	return slice(final, sliceParams)
+}
+
+func (intr *treeInterpreter) filterProjectionWithReflection(node ASTNode, value interface{}) (interface{}, error) {
+	compareNode := node.children[2]
+	collected := []interface{}{}
+	v := reflect.ValueOf(value)
+	for i := 0; i < v.Len(); i++ {
+		element := v.Index(i).Interface()
+		result, err := intr.Execute(compareNode, element)
+		if err != nil {
+			return nil, err
+		}
+		if !isFalse(result) {
+			current, err := intr.Execute(node.children[1], element)
+			if err != nil {
+				return nil, err
+			}
+			if current != nil {
+				collected = append(collected, current)
+			}
+		}
+	}
+	return collected, nil
+}
+
+func (intr *treeInterpreter) projectWithReflection(node ASTNode, value interface{}) (interface{}, error) {
+	collected := []interface{}{}
+	v := reflect.ValueOf(value)
+	for i := 0; i < v.Len(); i++ {
+		element := v.Index(i).Interface()
+		result, err := intr.Execute(node.children[1], element)
+		if err != nil {
+			return nil, err
+		}
+		if result != nil {
+			collected = append(collected, result)
+		}
+	}
+	return collected, nil
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/lexer.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/lexer.go
new file mode 100644
index 00000000..817900c8
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/lexer.go
@@ -0,0 +1,420 @@
+package jmespath
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"strconv"
+	"strings"
+	"unicode/utf8"
+)
+
+type token struct {
+	tokenType tokType
+	value     string
+	position  int
+	length    int
+}
+
+type tokType int
+
+const eof = -1
+
+// Lexer contains information about the expression being tokenized.
+type Lexer struct {
+	expression string       // The expression provided by the user.
+	currentPos int          // The current position in the string.
+	lastWidth  int          // The width of the current rune.  This
+	buf        bytes.Buffer // Internal buffer used for building up values.
+}
+
+// SyntaxError is the main error used whenever a lexing or parsing error occurs.
+type SyntaxError struct {
+	msg        string // Error message displayed to user
+	Expression string // Expression that generated a SyntaxError
+	Offset     int    // The location in the string where the error occurred
+}
+
+func (e SyntaxError) Error() string {
+	// In the future, it would be good to underline the specific
+	// location where the error occurred.
+	return "SyntaxError: " + e.msg
+}
+
+// HighlightLocation will show where the syntax error occurred.
+// It will place a "^" character on a line below the expression
+// at the point where the syntax error occurred.
+func (e SyntaxError) HighlightLocation() string {
+	return e.Expression + "\n" + strings.Repeat(" ", e.Offset) + "^"
+}
+
+//go:generate stringer -type=tokType
+const (
+	tUnknown tokType = iota
+	tStar
+	tDot
+	tFilter
+	tFlatten
+	tLparen
+	tRparen
+	tLbracket
+	tRbracket
+	tLbrace
+	tRbrace
+	tOr
+	tPipe
+	tNumber
+	tUnquotedIdentifier
+	tQuotedIdentifier
+	tComma
+	tColon
+	tLT
+	tLTE
+	tGT
+	tGTE
+	tEQ
+	tNE
+	tJSONLiteral
+	tStringLiteral
+	tCurrent
+	tExpref
+	tAnd
+	tNot
+	tEOF
+)
+
+var basicTokens = map[rune]tokType{
+	'.': tDot,
+	'*': tStar,
+	',': tComma,
+	':': tColon,
+	'{': tLbrace,
+	'}': tRbrace,
+	']': tRbracket, // tLbracket not included because it could be "[]"
+	'(': tLparen,
+	')': tRparen,
+	'@': tCurrent,
+}
+
+// Bit mask for [a-zA-Z_] shifted down 64 bits to fit in a single uint64.
+// When using this bitmask just be sure to shift the rune down 64 bits
+// before checking against identifierStartBits.
+const identifierStartBits uint64 = 576460745995190270
+
+// Bit mask for [a-zA-Z0-9], 128 bits -> 2 uint64s.
+var identifierTrailingBits = [2]uint64{287948901175001088, 576460745995190270}
+
+var whiteSpace = map[rune]bool{
+	' ': true, '\t': true, '\n': true, '\r': true,
+}
+
+func (t token) String() string {
+	return fmt.Sprintf("Token{%+v, %s, %d, %d}",
+		t.tokenType, t.value, t.position, t.length)
+}
+
+// NewLexer creates a new JMESPath lexer.
+func NewLexer() *Lexer {
+	lexer := Lexer{}
+	return &lexer
+}
+
+func (lexer *Lexer) next() rune {
+	if lexer.currentPos >= len(lexer.expression) {
+		lexer.lastWidth = 0
+		return eof
+	}
+	r, w := utf8.DecodeRuneInString(lexer.expression[lexer.currentPos:])
+	lexer.lastWidth = w
+	lexer.currentPos += w
+	return r
+}
+
+func (lexer *Lexer) back() {
+	lexer.currentPos -= lexer.lastWidth
+}
+
+func (lexer *Lexer) peek() rune {
+	t := lexer.next()
+	lexer.back()
+	return t
+}
+
+// tokenize takes an expression and returns corresponding tokens.
+func (lexer *Lexer) tokenize(expression string) ([]token, error) {
+	var tokens []token
+	lexer.expression = expression
+	lexer.currentPos = 0
+	lexer.lastWidth = 0
+loop:
+	for {
+		r := lexer.next()
+		if identifierStartBits&(1<<(uint64(r)-64)) > 0 {
+			t := lexer.consumeUnquotedIdentifier()
+			tokens = append(tokens, t)
+		} else if val, ok := basicTokens[r]; ok {
+			// Basic single char token.
+			t := token{
+				tokenType: val,
+				value:     string(r),
+				position:  lexer.currentPos - lexer.lastWidth,
+				length:    1,
+			}
+			tokens = append(tokens, t)
+		} else if r == '-' || (r >= '0' && r <= '9') {
+			t := lexer.consumeNumber()
+			tokens = append(tokens, t)
+		} else if r == '[' {
+			t := lexer.consumeLBracket()
+			tokens = append(tokens, t)
+		} else if r == '"' {
+			t, err := lexer.consumeQuotedIdentifier()
+			if err != nil {
+				return tokens, err
+			}
+			tokens = append(tokens, t)
+		} else if r == '\'' {
+			t, err := lexer.consumeRawStringLiteral()
+			if err != nil {
+				return tokens, err
+			}
+			tokens = append(tokens, t)
+		} else if r == '`' {
+			t, err := lexer.consumeLiteral()
+			if err != nil {
+				return tokens, err
+			}
+			tokens = append(tokens, t)
+		} else if r == '|' {
+			t := lexer.matchOrElse(r, '|', tOr, tPipe)
+			tokens = append(tokens, t)
+		} else if r == '<' {
+			t := lexer.matchOrElse(r, '=', tLTE, tLT)
+			tokens = append(tokens, t)
+		} else if r == '>' {
+			t := lexer.matchOrElse(r, '=', tGTE, tGT)
+			tokens = append(tokens, t)
+		} else if r == '!' {
+			t := lexer.matchOrElse(r, '=', tNE, tNot)
+			tokens = append(tokens, t)
+		} else if r == '=' {
+			t := lexer.matchOrElse(r, '=', tEQ, tUnknown)
+			tokens = append(tokens, t)
+		} else if r == '&' {
+			t := lexer.matchOrElse(r, '&', tAnd, tExpref)
+			tokens = append(tokens, t)
+		} else if r == eof {
+			break loop
+		} else if _, ok := whiteSpace[r]; ok {
+			// Ignore whitespace
+		} else {
+			return tokens, lexer.syntaxError(fmt.Sprintf("Unknown char: %s", strconv.QuoteRuneToASCII(r)))
+		}
+	}
+	tokens = append(tokens, token{tEOF, "", len(lexer.expression), 0})
+	return tokens, nil
+}
+
+// Consume characters until the ending rune "r" is reached.
+// If the end of the expression is reached before seeing the
+// terminating rune "r", then an error is returned.
+// If no error occurs then the matching substring is returned.
+// The returned string will not include the ending rune.
+func (lexer *Lexer) consumeUntil(end rune) (string, error) {
+	start := lexer.currentPos
+	current := lexer.next()
+	for current != end && current != eof {
+		if current == '\\' && lexer.peek() != eof {
+			lexer.next()
+		}
+		current = lexer.next()
+	}
+	if lexer.lastWidth == 0 {
+		// Then we hit an EOF so we never reached the closing
+		// delimiter.
+		return "", SyntaxError{
+			msg:        "Unclosed delimiter: " + string(end),
+			Expression: lexer.expression,
+			Offset:     len(lexer.expression),
+		}
+	}
+	return lexer.expression[start : lexer.currentPos-lexer.lastWidth], nil
+}
+
+func (lexer *Lexer) consumeLiteral() (token, error) {
+	start := lexer.currentPos
+	value, err := lexer.consumeUntil('`')
+	if err != nil {
+		return token{}, err
+	}
+	value = strings.Replace(value, "\\`", "`", -1)
+	return token{
+		tokenType: tJSONLiteral,
+		value:     value,
+		position:  start,
+		length:    len(value),
+	}, nil
+}
+
+func (lexer *Lexer) consumeRawStringLiteral() (token, error) {
+	start := lexer.currentPos
+	currentIndex := start
+	current := lexer.next()
+	for current != '\'' && lexer.peek() != eof {
+		if current == '\\' && lexer.peek() == '\'' {
+			chunk := lexer.expression[currentIndex : lexer.currentPos-1]
+			lexer.buf.WriteString(chunk)
+			lexer.buf.WriteString("'")
+			lexer.next()
+			currentIndex = lexer.currentPos
+		}
+		current = lexer.next()
+	}
+	if lexer.lastWidth == 0 {
+		// Then we hit an EOF so we never reached the closing
+		// delimiter.
+		return token{}, SyntaxError{
+			msg:        "Unclosed delimiter: '",
+			Expression: lexer.expression,
+			Offset:     len(lexer.expression),
+		}
+	}
+	if currentIndex < lexer.currentPos {
+		lexer.buf.WriteString(lexer.expression[currentIndex : lexer.currentPos-1])
+	}
+	value := lexer.buf.String()
+	// Reset the buffer so it can reused again.
+	lexer.buf.Reset()
+	return token{
+		tokenType: tStringLiteral,
+		value:     value,
+		position:  start,
+		length:    len(value),
+	}, nil
+}
+
+func (lexer *Lexer) syntaxError(msg string) SyntaxError {
+	return SyntaxError{
+		msg:        msg,
+		Expression: lexer.expression,
+		Offset:     lexer.currentPos - 1,
+	}
+}
+
+// Checks for a two char token, otherwise matches a single character
+// token. This is used whenever a two char token overlaps a single
+// char token, e.g. "||" -> tPipe, "|" -> tOr.
+func (lexer *Lexer) matchOrElse(first rune, second rune, matchedType tokType, singleCharType tokType) token {
+	start := lexer.currentPos - lexer.lastWidth
+	nextRune := lexer.next()
+	var t token
+	if nextRune == second {
+		t = token{
+			tokenType: matchedType,
+			value:     string(first) + string(second),
+			position:  start,
+			length:    2,
+		}
+	} else {
+		lexer.back()
+		t = token{
+			tokenType: singleCharType,
+			value:     string(first),
+			position:  start,
+			length:    1,
+		}
+	}
+	return t
+}
+
+func (lexer *Lexer) consumeLBracket() token {
+	// There's three options here:
+	// 1. A filter expression "[?"
+	// 2. A flatten operator "[]"
+	// 3. A bare rbracket "["
+	start := lexer.currentPos - lexer.lastWidth
+	nextRune := lexer.next()
+	var t token
+	if nextRune == '?' {
+		t = token{
+			tokenType: tFilter,
+			value:     "[?",
+			position:  start,
+			length:    2,
+		}
+	} else if nextRune == ']' {
+		t = token{
+			tokenType: tFlatten,
+			value:     "[]",
+			position:  start,
+			length:    2,
+		}
+	} else {
+		t = token{
+			tokenType: tLbracket,
+			value:     "[",
+			position:  start,
+			length:    1,
+		}
+		lexer.back()
+	}
+	return t
+}
+
+func (lexer *Lexer) consumeQuotedIdentifier() (token, error) {
+	start := lexer.currentPos
+	value, err := lexer.consumeUntil('"')
+	if err != nil {
+		return token{}, err
+	}
+	var decoded string
+	asJSON := []byte("\"" + value + "\"")
+	if err := json.Unmarshal([]byte(asJSON), &decoded); err != nil {
+		return token{}, err
+	}
+	return token{
+		tokenType: tQuotedIdentifier,
+		value:     decoded,
+		position:  start - 1,
+		length:    len(decoded),
+	}, nil
+}
+
+func (lexer *Lexer) consumeUnquotedIdentifier() token {
+	// Consume runes until we reach the end of an unquoted
+	// identifier.
+	start := lexer.currentPos - lexer.lastWidth
+	for {
+		r := lexer.next()
+		if r < 0 || r > 128 || identifierTrailingBits[uint64(r)/64]&(1<<(uint64(r)%64)) == 0 {
+			lexer.back()
+			break
+		}
+	}
+	value := lexer.expression[start:lexer.currentPos]
+	return token{
+		tokenType: tUnquotedIdentifier,
+		value:     value,
+		position:  start,
+		length:    lexer.currentPos - start,
+	}
+}
+
+func (lexer *Lexer) consumeNumber() token {
+	// Consume runes until we reach something that's not a number.
+	start := lexer.currentPos - lexer.lastWidth
+	for {
+		r := lexer.next()
+		if r < '0' || r > '9' {
+			lexer.back()
+			break
+		}
+	}
+	value := lexer.expression[start:lexer.currentPos]
+	return token{
+		tokenType: tNumber,
+		value:     value,
+		position:  start,
+		length:    lexer.currentPos - start,
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/parser.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/parser.go
new file mode 100644
index 00000000..1240a175
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/parser.go
@@ -0,0 +1,603 @@
+package jmespath
+
+import (
+	"encoding/json"
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+type astNodeType int
+
+//go:generate stringer -type astNodeType
+const (
+	ASTEmpty astNodeType = iota
+	ASTComparator
+	ASTCurrentNode
+	ASTExpRef
+	ASTFunctionExpression
+	ASTField
+	ASTFilterProjection
+	ASTFlatten
+	ASTIdentity
+	ASTIndex
+	ASTIndexExpression
+	ASTKeyValPair
+	ASTLiteral
+	ASTMultiSelectHash
+	ASTMultiSelectList
+	ASTOrExpression
+	ASTAndExpression
+	ASTNotExpression
+	ASTPipe
+	ASTProjection
+	ASTSubexpression
+	ASTSlice
+	ASTValueProjection
+)
+
+// ASTNode represents the abstract syntax tree of a JMESPath expression.
+type ASTNode struct {
+	nodeType astNodeType
+	value    interface{}
+	children []ASTNode
+}
+
+func (node ASTNode) String() string {
+	return node.PrettyPrint(0)
+}
+
+// PrettyPrint will pretty print the parsed AST.
+// The AST is an implementation detail and this pretty print
+// function is provided as a convenience method to help with
+// debugging.  You should not rely on its output as the internal
+// structure of the AST may change at any time.
+func (node ASTNode) PrettyPrint(indent int) string {
+	spaces := strings.Repeat(" ", indent)
+	output := fmt.Sprintf("%s%s {\n", spaces, node.nodeType)
+	nextIndent := indent + 2
+	if node.value != nil {
+		if converted, ok := node.value.(fmt.Stringer); ok {
+			// Account for things like comparator nodes
+			// that are enums with a String() method.
+			output += fmt.Sprintf("%svalue: %s\n", strings.Repeat(" ", nextIndent), converted.String())
+		} else {
+			output += fmt.Sprintf("%svalue: %#v\n", strings.Repeat(" ", nextIndent), node.value)
+		}
+	}
+	lastIndex := len(node.children)
+	if lastIndex > 0 {
+		output += fmt.Sprintf("%schildren: {\n", strings.Repeat(" ", nextIndent))
+		childIndent := nextIndent + 2
+		for _, elem := range node.children {
+			output += elem.PrettyPrint(childIndent)
+		}
+	}
+	output += fmt.Sprintf("%s}\n", spaces)
+	return output
+}
+
+var bindingPowers = map[tokType]int{
+	tEOF:                0,
+	tUnquotedIdentifier: 0,
+	tQuotedIdentifier:   0,
+	tRbracket:           0,
+	tRparen:             0,
+	tComma:              0,
+	tRbrace:             0,
+	tNumber:             0,
+	tCurrent:            0,
+	tExpref:             0,
+	tColon:              0,
+	tPipe:               1,
+	tOr:                 2,
+	tAnd:                3,
+	tEQ:                 5,
+	tLT:                 5,
+	tLTE:                5,
+	tGT:                 5,
+	tGTE:                5,
+	tNE:                 5,
+	tFlatten:            9,
+	tStar:               20,
+	tFilter:             21,
+	tDot:                40,
+	tNot:                45,
+	tLbrace:             50,
+	tLbracket:           55,
+	tLparen:             60,
+}
+
+// Parser holds state about the current expression being parsed.
+type Parser struct {
+	expression string
+	tokens     []token
+	index      int
+}
+
+// NewParser creates a new JMESPath parser.
+func NewParser() *Parser {
+	p := Parser{}
+	return &p
+}
+
+// Parse will compile a JMESPath expression.
+func (p *Parser) Parse(expression string) (ASTNode, error) {
+	lexer := NewLexer()
+	p.expression = expression
+	p.index = 0
+	tokens, err := lexer.tokenize(expression)
+	if err != nil {
+		return ASTNode{}, err
+	}
+	p.tokens = tokens
+	parsed, err := p.parseExpression(0)
+	if err != nil {
+		return ASTNode{}, err
+	}
+	if p.current() != tEOF {
+		return ASTNode{}, p.syntaxError(fmt.Sprintf(
+			"Unexpected token at the end of the expresssion: %s", p.current()))
+	}
+	return parsed, nil
+}
+
+func (p *Parser) parseExpression(bindingPower int) (ASTNode, error) {
+	var err error
+	leftToken := p.lookaheadToken(0)
+	p.advance()
+	leftNode, err := p.nud(leftToken)
+	if err != nil {
+		return ASTNode{}, err
+	}
+	currentToken := p.current()
+	for bindingPower < bindingPowers[currentToken] {
+		p.advance()
+		leftNode, err = p.led(currentToken, leftNode)
+		if err != nil {
+			return ASTNode{}, err
+		}
+		currentToken = p.current()
+	}
+	return leftNode, nil
+}
+
+func (p *Parser) parseIndexExpression() (ASTNode, error) {
+	if p.lookahead(0) == tColon || p.lookahead(1) == tColon {
+		return p.parseSliceExpression()
+	}
+	indexStr := p.lookaheadToken(0).value
+	parsedInt, err := strconv.Atoi(indexStr)
+	if err != nil {
+		return ASTNode{}, err
+	}
+	indexNode := ASTNode{nodeType: ASTIndex, value: parsedInt}
+	p.advance()
+	if err := p.match(tRbracket); err != nil {
+		return ASTNode{}, err
+	}
+	return indexNode, nil
+}
+
+func (p *Parser) parseSliceExpression() (ASTNode, error) {
+	parts := []*int{nil, nil, nil}
+	index := 0
+	current := p.current()
+	for current != tRbracket && index < 3 {
+		if current == tColon {
+			index++
+			p.advance()
+		} else if current == tNumber {
+			parsedInt, err := strconv.Atoi(p.lookaheadToken(0).value)
+			if err != nil {
+				return ASTNode{}, err
+			}
+			parts[index] = &parsedInt
+			p.advance()
+		} else {
+			return ASTNode{}, p.syntaxError(
+				"Expected tColon or tNumber" + ", received: " + p.current().String())
+		}
+		current = p.current()
+	}
+	if err := p.match(tRbracket); err != nil {
+		return ASTNode{}, err
+	}
+	return ASTNode{
+		nodeType: ASTSlice,
+		value:    parts,
+	}, nil
+}
+
+func (p *Parser) match(tokenType tokType) error {
+	if p.current() == tokenType {
+		p.advance()
+		return nil
+	}
+	return p.syntaxError("Expected " + tokenType.String() + ", received: " + p.current().String())
+}
+
+func (p *Parser) led(tokenType tokType, node ASTNode) (ASTNode, error) {
+	switch tokenType {
+	case tDot:
+		if p.current() != tStar {
+			right, err := p.parseDotRHS(bindingPowers[tDot])
+			return ASTNode{
+				nodeType: ASTSubexpression,
+				children: []ASTNode{node, right},
+			}, err
+		}
+		p.advance()
+		right, err := p.parseProjectionRHS(bindingPowers[tDot])
+		return ASTNode{
+			nodeType: ASTValueProjection,
+			children: []ASTNode{node, right},
+		}, err
+	case tPipe:
+		right, err := p.parseExpression(bindingPowers[tPipe])
+		return ASTNode{nodeType: ASTPipe, children: []ASTNode{node, right}}, err
+	case tOr:
+		right, err := p.parseExpression(bindingPowers[tOr])
+		return ASTNode{nodeType: ASTOrExpression, children: []ASTNode{node, right}}, err
+	case tAnd:
+		right, err := p.parseExpression(bindingPowers[tAnd])
+		return ASTNode{nodeType: ASTAndExpression, children: []ASTNode{node, right}}, err
+	case tLparen:
+		name := node.value
+		var args []ASTNode
+		for p.current() != tRparen {
+			expression, err := p.parseExpression(0)
+			if err != nil {
+				return ASTNode{}, err
+			}
+			if p.current() == tComma {
+				if err := p.match(tComma); err != nil {
+					return ASTNode{}, err
+				}
+			}
+			args = append(args, expression)
+		}
+		if err := p.match(tRparen); err != nil {
+			return ASTNode{}, err
+		}
+		return ASTNode{
+			nodeType: ASTFunctionExpression,
+			value:    name,
+			children: args,
+		}, nil
+	case tFilter:
+		return p.parseFilter(node)
+	case tFlatten:
+		left := ASTNode{nodeType: ASTFlatten, children: []ASTNode{node}}
+		right, err := p.parseProjectionRHS(bindingPowers[tFlatten])
+		return ASTNode{
+			nodeType: ASTProjection,
+			children: []ASTNode{left, right},
+		}, err
+	case tEQ, tNE, tGT, tGTE, tLT, tLTE:
+		right, err := p.parseExpression(bindingPowers[tokenType])
+		if err != nil {
+			return ASTNode{}, err
+		}
+		return ASTNode{
+			nodeType: ASTComparator,
+			value:    tokenType,
+			children: []ASTNode{node, right},
+		}, nil
+	case tLbracket:
+		tokenType := p.current()
+		var right ASTNode
+		var err error
+		if tokenType == tNumber || tokenType == tColon {
+			right, err = p.parseIndexExpression()
+			if err != nil {
+				return ASTNode{}, err
+			}
+			return p.projectIfSlice(node, right)
+		}
+		// Otherwise this is a projection.
+		if err := p.match(tStar); err != nil {
+			return ASTNode{}, err
+		}
+		if err := p.match(tRbracket); err != nil {
+			return ASTNode{}, err
+		}
+		right, err = p.parseProjectionRHS(bindingPowers[tStar])
+		if err != nil {
+			return ASTNode{}, err
+		}
+		return ASTNode{
+			nodeType: ASTProjection,
+			children: []ASTNode{node, right},
+		}, nil
+	}
+	return ASTNode{}, p.syntaxError("Unexpected token: " + tokenType.String())
+}
+
+func (p *Parser) nud(token token) (ASTNode, error) {
+	switch token.tokenType {
+	case tJSONLiteral:
+		var parsed interface{}
+		err := json.Unmarshal([]byte(token.value), &parsed)
+		if err != nil {
+			return ASTNode{}, err
+		}
+		return ASTNode{nodeType: ASTLiteral, value: parsed}, nil
+	case tStringLiteral:
+		return ASTNode{nodeType: ASTLiteral, value: token.value}, nil
+	case tUnquotedIdentifier:
+		return ASTNode{
+			nodeType: ASTField,
+			value:    token.value,
+		}, nil
+	case tQuotedIdentifier:
+		node := ASTNode{nodeType: ASTField, value: token.value}
+		if p.current() == tLparen {
+			return ASTNode{}, p.syntaxErrorToken("Can't have quoted identifier as function name.", token)
+		}
+		return node, nil
+	case tStar:
+		left := ASTNode{nodeType: ASTIdentity}
+		var right ASTNode
+		var err error
+		if p.current() == tRbracket {
+			right = ASTNode{nodeType: ASTIdentity}
+		} else {
+			right, err = p.parseProjectionRHS(bindingPowers[tStar])
+		}
+		return ASTNode{nodeType: ASTValueProjection, children: []ASTNode{left, right}}, err
+	case tFilter:
+		return p.parseFilter(ASTNode{nodeType: ASTIdentity})
+	case tLbrace:
+		return p.parseMultiSelectHash()
+	case tFlatten:
+		left := ASTNode{
+			nodeType: ASTFlatten,
+			children: []ASTNode{{nodeType: ASTIdentity}},
+		}
+		right, err := p.parseProjectionRHS(bindingPowers[tFlatten])
+		if err != nil {
+			return ASTNode{}, err
+		}
+		return ASTNode{nodeType: ASTProjection, children: []ASTNode{left, right}}, nil
+	case tLbracket:
+		tokenType := p.current()
+		//var right ASTNode
+		if tokenType == tNumber || tokenType == tColon {
+			right, err := p.parseIndexExpression()
+			if err != nil {
+				return ASTNode{}, nil
+			}
+			return p.projectIfSlice(ASTNode{nodeType: ASTIdentity}, right)
+		} else if tokenType == tStar && p.lookahead(1) == tRbracket {
+			p.advance()
+			p.advance()
+			right, err := p.parseProjectionRHS(bindingPowers[tStar])
+			if err != nil {
+				return ASTNode{}, err
+			}
+			return ASTNode{
+				nodeType: ASTProjection,
+				children: []ASTNode{{nodeType: ASTIdentity}, right},
+			}, nil
+		} else {
+			return p.parseMultiSelectList()
+		}
+	case tCurrent:
+		return ASTNode{nodeType: ASTCurrentNode}, nil
+	case tExpref:
+		expression, err := p.parseExpression(bindingPowers[tExpref])
+		if err != nil {
+			return ASTNode{}, err
+		}
+		return ASTNode{nodeType: ASTExpRef, children: []ASTNode{expression}}, nil
+	case tNot:
+		expression, err := p.parseExpression(bindingPowers[tNot])
+		if err != nil {
+			return ASTNode{}, err
+		}
+		return ASTNode{nodeType: ASTNotExpression, children: []ASTNode{expression}}, nil
+	case tLparen:
+		expression, err := p.parseExpression(0)
+		if err != nil {
+			return ASTNode{}, err
+		}
+		if err := p.match(tRparen); err != nil {
+			return ASTNode{}, err
+		}
+		return expression, nil
+	case tEOF:
+		return ASTNode{}, p.syntaxErrorToken("Incomplete expression", token)
+	}
+
+	return ASTNode{}, p.syntaxErrorToken("Invalid token: "+token.tokenType.String(), token)
+}
+
+func (p *Parser) parseMultiSelectList() (ASTNode, error) {
+	var expressions []ASTNode
+	for {
+		expression, err := p.parseExpression(0)
+		if err != nil {
+			return ASTNode{}, err
+		}
+		expressions = append(expressions, expression)
+		if p.current() == tRbracket {
+			break
+		}
+		err = p.match(tComma)
+		if err != nil {
+			return ASTNode{}, err
+		}
+	}
+	err := p.match(tRbracket)
+	if err != nil {
+		return ASTNode{}, err
+	}
+	return ASTNode{
+		nodeType: ASTMultiSelectList,
+		children: expressions,
+	}, nil
+}
+
+func (p *Parser) parseMultiSelectHash() (ASTNode, error) {
+	var children []ASTNode
+	for {
+		keyToken := p.lookaheadToken(0)
+		if err := p.match(tUnquotedIdentifier); err != nil {
+			if err := p.match(tQuotedIdentifier); err != nil {
+				return ASTNode{}, p.syntaxError("Expected tQuotedIdentifier or tUnquotedIdentifier")
+			}
+		}
+		keyName := keyToken.value
+		err := p.match(tColon)
+		if err != nil {
+			return ASTNode{}, err
+		}
+		value, err := p.parseExpression(0)
+		if err != nil {
+			return ASTNode{}, err
+		}
+		node := ASTNode{
+			nodeType: ASTKeyValPair,
+			value:    keyName,
+			children: []ASTNode{value},
+		}
+		children = append(children, node)
+		if p.current() == tComma {
+			err := p.match(tComma)
+			if err != nil {
+				return ASTNode{}, nil
+			}
+		} else if p.current() == tRbrace {
+			err := p.match(tRbrace)
+			if err != nil {
+				return ASTNode{}, nil
+			}
+			break
+		}
+	}
+	return ASTNode{
+		nodeType: ASTMultiSelectHash,
+		children: children,
+	}, nil
+}
+
+func (p *Parser) projectIfSlice(left ASTNode, right ASTNode) (ASTNode, error) {
+	indexExpr := ASTNode{
+		nodeType: ASTIndexExpression,
+		children: []ASTNode{left, right},
+	}
+	if right.nodeType == ASTSlice {
+		right, err := p.parseProjectionRHS(bindingPowers[tStar])
+		return ASTNode{
+			nodeType: ASTProjection,
+			children: []ASTNode{indexExpr, right},
+		}, err
+	}
+	return indexExpr, nil
+}
+func (p *Parser) parseFilter(node ASTNode) (ASTNode, error) {
+	var right, condition ASTNode
+	var err error
+	condition, err = p.parseExpression(0)
+	if err != nil {
+		return ASTNode{}, err
+	}
+	if err := p.match(tRbracket); err != nil {
+		return ASTNode{}, err
+	}
+	if p.current() == tFlatten {
+		right = ASTNode{nodeType: ASTIdentity}
+	} else {
+		right, err = p.parseProjectionRHS(bindingPowers[tFilter])
+		if err != nil {
+			return ASTNode{}, err
+		}
+	}
+
+	return ASTNode{
+		nodeType: ASTFilterProjection,
+		children: []ASTNode{node, right, condition},
+	}, nil
+}
+
+func (p *Parser) parseDotRHS(bindingPower int) (ASTNode, error) {
+	lookahead := p.current()
+	if tokensOneOf([]tokType{tQuotedIdentifier, tUnquotedIdentifier, tStar}, lookahead) {
+		return p.parseExpression(bindingPower)
+	} else if lookahead == tLbracket {
+		if err := p.match(tLbracket); err != nil {
+			return ASTNode{}, err
+		}
+		return p.parseMultiSelectList()
+	} else if lookahead == tLbrace {
+		if err := p.match(tLbrace); err != nil {
+			return ASTNode{}, err
+		}
+		return p.parseMultiSelectHash()
+	}
+	return ASTNode{}, p.syntaxError("Expected identifier, lbracket, or lbrace")
+}
+
+func (p *Parser) parseProjectionRHS(bindingPower int) (ASTNode, error) {
+	current := p.current()
+	if bindingPowers[current] < 10 {
+		return ASTNode{nodeType: ASTIdentity}, nil
+	} else if current == tLbracket {
+		return p.parseExpression(bindingPower)
+	} else if current == tFilter {
+		return p.parseExpression(bindingPower)
+	} else if current == tDot {
+		err := p.match(tDot)
+		if err != nil {
+			return ASTNode{}, err
+		}
+		return p.parseDotRHS(bindingPower)
+	} else {
+		return ASTNode{}, p.syntaxError("Error")
+	}
+}
+
+func (p *Parser) lookahead(number int) tokType {
+	return p.lookaheadToken(number).tokenType
+}
+
+func (p *Parser) current() tokType {
+	return p.lookahead(0)
+}
+
+func (p *Parser) lookaheadToken(number int) token {
+	return p.tokens[p.index+number]
+}
+
+func (p *Parser) advance() {
+	p.index++
+}
+
+func tokensOneOf(elements []tokType, token tokType) bool {
+	for _, elem := range elements {
+		if elem == token {
+			return true
+		}
+	}
+	return false
+}
+
+func (p *Parser) syntaxError(msg string) SyntaxError {
+	return SyntaxError{
+		msg:        msg,
+		Expression: p.expression,
+		Offset:     p.lookaheadToken(0).position,
+	}
+}
+
+// Create a SyntaxError based on the provided token.
+// This differs from syntaxError() which creates a SyntaxError
+// based on the current lookahead token.
+func (p *Parser) syntaxErrorToken(msg string, t token) SyntaxError {
+	return SyntaxError{
+		msg:        msg,
+		Expression: p.expression,
+		Offset:     t.position,
+	}
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/toktype_string.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/toktype_string.go
new file mode 100644
index 00000000..dae79cbd
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/toktype_string.go
@@ -0,0 +1,16 @@
+// generated by stringer -type=tokType; DO NOT EDIT
+
+package jmespath
+
+import "fmt"
+
+const _tokType_name = "tUnknowntStartDottFiltertFlattentLparentRparentLbrackettRbrackettLbracetRbracetOrtPipetNumbertUnquotedIdentifiertQuotedIdentifiertCommatColontLTtLTEtGTtGTEtEQtNEtJSONLiteraltStringLiteraltCurrenttExpreftAndtNottEOF"
+
+var _tokType_index = [...]uint8{0, 8, 13, 17, 24, 32, 39, 46, 55, 64, 71, 78, 81, 86, 93, 112, 129, 135, 141, 144, 148, 151, 155, 158, 161, 173, 187, 195, 202, 206, 210, 214}
+
+func (i tokType) String() string {
+	if i < 0 || i >= tokType(len(_tokType_index)-1) {
+		return fmt.Sprintf("tokType(%d)", i)
+	}
+	return _tokType_name[_tokType_index[i]:_tokType_index[i+1]]
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/util.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/util.go
new file mode 100644
index 00000000..ddc1b7d7
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/jmespath/go-jmespath/util.go
@@ -0,0 +1,185 @@
+package jmespath
+
+import (
+	"errors"
+	"reflect"
+)
+
+// IsFalse determines if an object is false based on the JMESPath spec.
+// JMESPath defines false values to be any of:
+// - An empty string array, or hash.
+// - The boolean value false.
+// - nil
+func isFalse(value interface{}) bool {
+	switch v := value.(type) {
+	case bool:
+		return !v
+	case []interface{}:
+		return len(v) == 0
+	case map[string]interface{}:
+		return len(v) == 0
+	case string:
+		return len(v) == 0
+	case nil:
+		return true
+	}
+	// Try the reflection cases before returning false.
+	rv := reflect.ValueOf(value)
+	switch rv.Kind() {
+	case reflect.Struct:
+		// A struct type will never be false, even if
+		// all of its values are the zero type.
+		return false
+	case reflect.Slice, reflect.Map:
+		return rv.Len() == 0
+	case reflect.Ptr:
+		if rv.IsNil() {
+			return true
+		}
+		// If it's a pointer type, we'll try to deref the pointer
+		// and evaluate the pointer value for isFalse.
+		element := rv.Elem()
+		return isFalse(element.Interface())
+	}
+	return false
+}
+
+// ObjsEqual is a generic object equality check.
+// It will take two arbitrary objects and recursively determine
+// if they are equal.
+func objsEqual(left interface{}, right interface{}) bool {
+	return reflect.DeepEqual(left, right)
+}
+
+// SliceParam refers to a single part of a slice.
+// A slice consists of a start, a stop, and a step, similar to
+// python slices.
+type sliceParam struct {
+	N         int
+	Specified bool
+}
+
+// Slice supports [start:stop:step] style slicing that's supported in JMESPath.
+func slice(slice []interface{}, parts []sliceParam) ([]interface{}, error) {
+	computed, err := computeSliceParams(len(slice), parts)
+	if err != nil {
+		return nil, err
+	}
+	start, stop, step := computed[0], computed[1], computed[2]
+	result := []interface{}{}
+	if step > 0 {
+		for i := start; i < stop; i += step {
+			result = append(result, slice[i])
+		}
+	} else {
+		for i := start; i > stop; i += step {
+			result = append(result, slice[i])
+		}
+	}
+	return result, nil
+}
+
+func computeSliceParams(length int, parts []sliceParam) ([]int, error) {
+	var start, stop, step int
+	if !parts[2].Specified {
+		step = 1
+	} else if parts[2].N == 0 {
+		return nil, errors.New("Invalid slice, step cannot be 0")
+	} else {
+		step = parts[2].N
+	}
+	var stepValueNegative bool
+	if step < 0 {
+		stepValueNegative = true
+	} else {
+		stepValueNegative = false
+	}
+
+	if !parts[0].Specified {
+		if stepValueNegative {
+			start = length - 1
+		} else {
+			start = 0
+		}
+	} else {
+		start = capSlice(length, parts[0].N, step)
+	}
+
+	if !parts[1].Specified {
+		if stepValueNegative {
+			stop = -1
+		} else {
+			stop = length
+		}
+	} else {
+		stop = capSlice(length, parts[1].N, step)
+	}
+	return []int{start, stop, step}, nil
+}
+
+func capSlice(length int, actual int, step int) int {
+	if actual < 0 {
+		actual += length
+		if actual < 0 {
+			if step < 0 {
+				actual = -1
+			} else {
+				actual = 0
+			}
+		}
+	} else if actual >= length {
+		if step < 0 {
+			actual = length - 1
+		} else {
+			actual = length
+		}
+	}
+	return actual
+}
+
+// ToArrayNum converts an empty interface type to a slice of float64.
+// If any element in the array cannot be converted, then nil is returned
+// along with a second value of false.
+func toArrayNum(data interface{}) ([]float64, bool) {
+	// Is there a better way to do this with reflect?
+	if d, ok := data.([]interface{}); ok {
+		result := make([]float64, len(d))
+		for i, el := range d {
+			item, ok := el.(float64)
+			if !ok {
+				return nil, false
+			}
+			result[i] = item
+		}
+		return result, true
+	}
+	return nil, false
+}
+
+// ToArrayStr converts an empty interface type to a slice of strings.
+// If any element in the array cannot be converted, then nil is returned
+// along with a second value of false.  If the input data could be entirely
+// converted, then the converted data, along with a second value of true,
+// will be returned.
+func toArrayStr(data interface{}) ([]string, bool) {
+	// Is there a better way to do this with reflect?
+	if d, ok := data.([]interface{}); ok {
+		result := make([]string, len(d))
+		for i, el := range d {
+			item, ok := el.(string)
+			if !ok {
+				return nil, false
+			}
+			result[i] = item
+		}
+		return result, true
+	}
+	return nil, false
+}
+
+func isSliceType(v interface{}) bool {
+	if v == nil {
+		return false
+	}
+	return reflect.TypeOf(v).Kind() == reflect.Slice
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/pkg/errors/.gitignore b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/pkg/errors/.gitignore
new file mode 100644
index 00000000..daf913b1
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/pkg/errors/.gitignore
@@ -0,0 +1,24 @@
+# Compiled Object files, Static and Dynamic libs (Shared Objects)
+*.o
+*.a
+*.so
+
+# Folders
+_obj
+_test
+
+# Architecture specific extensions/prefixes
+*.[568vq]
+[568vq].out
+
+*.cgo1.go
+*.cgo2.c
+_cgo_defun.c
+_cgo_gotypes.go
+_cgo_export.*
+
+_testmain.go
+
+*.exe
+*.test
+*.prof
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/pkg/errors/.travis.yml b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/pkg/errors/.travis.yml
new file mode 100644
index 00000000..588ceca1
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/pkg/errors/.travis.yml
@@ -0,0 +1,11 @@
+language: go
+go_import_path: github.com/pkg/errors
+go:
+  - 1.4.3
+  - 1.5.4
+  - 1.6.2
+  - 1.7.1
+  - tip
+
+script:
+  - go test -v ./...
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/pkg/errors/LICENSE b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/pkg/errors/LICENSE
new file mode 100644
index 00000000..835ba3e7
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/pkg/errors/LICENSE
@@ -0,0 +1,23 @@
+Copyright (c) 2015, Dave Cheney <dave@cheney.net>
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this
+  list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice,
+  this list of conditions and the following disclaimer in the documentation
+  and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/pkg/errors/README.md b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/pkg/errors/README.md
new file mode 100644
index 00000000..273db3c9
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/pkg/errors/README.md
@@ -0,0 +1,52 @@
+# errors [![Travis-CI](https://travis-ci.org/pkg/errors.svg)](https://travis-ci.org/pkg/errors) [![AppVeyor](https://ci.appveyor.com/api/projects/status/b98mptawhudj53ep/branch/master?svg=true)](https://ci.appveyor.com/project/davecheney/errors/branch/master) [![GoDoc](https://godoc.org/github.com/pkg/errors?status.svg)](http://godoc.org/github.com/pkg/errors) [![Report card](https://goreportcard.com/badge/github.com/pkg/errors)](https://goreportcard.com/report/github.com/pkg/errors)
+
+Package errors provides simple error handling primitives.
+
+`go get github.com/pkg/errors`
+
+The traditional error handling idiom in Go is roughly akin to
+```go
+if err != nil {
+        return err
+}
+```
+which applied recursively up the call stack results in error reports without context or debugging information. The errors package allows programmers to add context to the failure path in their code in a way that does not destroy the original value of the error.
+
+## Adding context to an error
+
+The errors.Wrap function returns a new error that adds context to the original error. For example
+```go
+_, err := ioutil.ReadAll(r)
+if err != nil {
+        return errors.Wrap(err, "read failed")
+}
+```
+## Retrieving the cause of an error
+
+Using `errors.Wrap` constructs a stack of errors, adding context to the preceding error. Depending on the nature of the error it may be necessary to reverse the operation of errors.Wrap to retrieve the original error for inspection. Any error value which implements this interface can be inspected by `errors.Cause`.
+```go
+type causer interface {
+        Cause() error
+}
+```
+`errors.Cause` will recursively retrieve the topmost error which does not implement `causer`, which is assumed to be the original cause. For example:
+```go
+switch err := errors.Cause(err).(type) {
+case *MyError:
+        // handle specifically
+default:
+        // unknown error
+}
+```
+
+[Read the package documentation for more information](https://godoc.org/github.com/pkg/errors).
+
+## Contributing
+
+We welcome pull requests, bug fixes and issue reports. With that said, the bar for adding new symbols to this package is intentionally set high.
+
+Before proposing a change, please discuss your change by raising an issue.
+
+## Licence
+
+BSD-2-Clause
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/pkg/errors/appveyor.yml b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/pkg/errors/appveyor.yml
new file mode 100644
index 00000000..a932eade
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/pkg/errors/appveyor.yml
@@ -0,0 +1,32 @@
+version: build-{build}.{branch}
+
+clone_folder: C:\gopath\src\github.com\pkg\errors
+shallow_clone: true # for startup speed
+
+environment:
+  GOPATH: C:\gopath
+
+platform:
+  - x64
+
+# http://www.appveyor.com/docs/installed-software
+install:
+  # some helpful output for debugging builds
+  - go version
+  - go env
+  # pre-installed MinGW at C:\MinGW is 32bit only
+  # but MSYS2 at C:\msys64 has mingw64
+  - set PATH=C:\msys64\mingw64\bin;%PATH%
+  - gcc --version
+  - g++ --version
+
+build_script:
+  - go install -v ./...
+
+test_script:
+  - set PATH=C:\gopath\bin;%PATH%
+  - go test -v ./...
+
+#artifacts:
+#  - path: '%GOPATH%\bin\*.exe'
+deploy: off
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/pkg/errors/errors.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/pkg/errors/errors.go
new file mode 100644
index 00000000..842ee804
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/pkg/errors/errors.go
@@ -0,0 +1,269 @@
+// Package errors provides simple error handling primitives.
+//
+// The traditional error handling idiom in Go is roughly akin to
+//
+//     if err != nil {
+//             return err
+//     }
+//
+// which applied recursively up the call stack results in error reports
+// without context or debugging information. The errors package allows
+// programmers to add context to the failure path in their code in a way
+// that does not destroy the original value of the error.
+//
+// Adding context to an error
+//
+// The errors.Wrap function returns a new error that adds context to the
+// original error by recording a stack trace at the point Wrap is called,
+// and the supplied message. For example
+//
+//     _, err := ioutil.ReadAll(r)
+//     if err != nil {
+//             return errors.Wrap(err, "read failed")
+//     }
+//
+// If additional control is required the errors.WithStack and errors.WithMessage
+// functions destructure errors.Wrap into its component operations of annotating
+// an error with a stack trace and an a message, respectively.
+//
+// Retrieving the cause of an error
+//
+// Using errors.Wrap constructs a stack of errors, adding context to the
+// preceding error. Depending on the nature of the error it may be necessary
+// to reverse the operation of errors.Wrap to retrieve the original error
+// for inspection. Any error value which implements this interface
+//
+//     type causer interface {
+//             Cause() error
+//     }
+//
+// can be inspected by errors.Cause. errors.Cause will recursively retrieve
+// the topmost error which does not implement causer, which is assumed to be
+// the original cause. For example:
+//
+//     switch err := errors.Cause(err).(type) {
+//     case *MyError:
+//             // handle specifically
+//     default:
+//             // unknown error
+//     }
+//
+// causer interface is not exported by this package, but is considered a part
+// of stable public API.
+//
+// Formatted printing of errors
+//
+// All error values returned from this package implement fmt.Formatter and can
+// be formatted by the fmt package. The following verbs are supported
+//
+//     %s    print the error. If the error has a Cause it will be
+//           printed recursively
+//     %v    see %s
+//     %+v   extended format. Each Frame of the error's StackTrace will
+//           be printed in detail.
+//
+// Retrieving the stack trace of an error or wrapper
+//
+// New, Errorf, Wrap, and Wrapf record a stack trace at the point they are
+// invoked. This information can be retrieved with the following interface.
+//
+//     type stackTracer interface {
+//             StackTrace() errors.StackTrace
+//     }
+//
+// Where errors.StackTrace is defined as
+//
+//     type StackTrace []Frame
+//
+// The Frame type represents a call site in the stack trace. Frame supports
+// the fmt.Formatter interface that can be used for printing information about
+// the stack trace of this error. For example:
+//
+//     if err, ok := err.(stackTracer); ok {
+//             for _, f := range err.StackTrace() {
+//                     fmt.Printf("%+s:%d", f)
+//             }
+//     }
+//
+// stackTracer interface is not exported by this package, but is considered a part
+// of stable public API.
+//
+// See the documentation for Frame.Format for more details.
+package errors
+
+import (
+	"fmt"
+	"io"
+)
+
+// New returns an error with the supplied message.
+// New also records the stack trace at the point it was called.
+func New(message string) error {
+	return &fundamental{
+		msg:   message,
+		stack: callers(),
+	}
+}
+
+// Errorf formats according to a format specifier and returns the string
+// as a value that satisfies error.
+// Errorf also records the stack trace at the point it was called.
+func Errorf(format string, args ...interface{}) error {
+	return &fundamental{
+		msg:   fmt.Sprintf(format, args...),
+		stack: callers(),
+	}
+}
+
+// fundamental is an error that has a message and a stack, but no caller.
+type fundamental struct {
+	msg string
+	*stack
+}
+
+func (f *fundamental) Error() string { return f.msg }
+
+func (f *fundamental) Format(s fmt.State, verb rune) {
+	switch verb {
+	case 'v':
+		if s.Flag('+') {
+			io.WriteString(s, f.msg)
+			f.stack.Format(s, verb)
+			return
+		}
+		fallthrough
+	case 's':
+		io.WriteString(s, f.msg)
+	case 'q':
+		fmt.Fprintf(s, "%q", f.msg)
+	}
+}
+
+// WithStack annotates err with a stack trace at the point WithStack was called.
+// If err is nil, WithStack returns nil.
+func WithStack(err error) error {
+	if err == nil {
+		return nil
+	}
+	return &withStack{
+		err,
+		callers(),
+	}
+}
+
+type withStack struct {
+	error
+	*stack
+}
+
+func (w *withStack) Cause() error { return w.error }
+
+func (w *withStack) Format(s fmt.State, verb rune) {
+	switch verb {
+	case 'v':
+		if s.Flag('+') {
+			fmt.Fprintf(s, "%+v", w.Cause())
+			w.stack.Format(s, verb)
+			return
+		}
+		fallthrough
+	case 's':
+		io.WriteString(s, w.Error())
+	case 'q':
+		fmt.Fprintf(s, "%q", w.Error())
+	}
+}
+
+// Wrap returns an error annotating err with a stack trace
+// at the point Wrap is called, and the supplied message.
+// If err is nil, Wrap returns nil.
+func Wrap(err error, message string) error {
+	if err == nil {
+		return nil
+	}
+	err = &withMessage{
+		cause: err,
+		msg:   message,
+	}
+	return &withStack{
+		err,
+		callers(),
+	}
+}
+
+// Wrapf returns an error annotating err with a stack trace
+// at the point Wrapf is call, and the format specifier.
+// If err is nil, Wrapf returns nil.
+func Wrapf(err error, format string, args ...interface{}) error {
+	if err == nil {
+		return nil
+	}
+	err = &withMessage{
+		cause: err,
+		msg:   fmt.Sprintf(format, args...),
+	}
+	return &withStack{
+		err,
+		callers(),
+	}
+}
+
+// WithMessage annotates err with a new message.
+// If err is nil, WithMessage returns nil.
+func WithMessage(err error, message string) error {
+	if err == nil {
+		return nil
+	}
+	return &withMessage{
+		cause: err,
+		msg:   message,
+	}
+}
+
+type withMessage struct {
+	cause error
+	msg   string
+}
+
+func (w *withMessage) Error() string { return w.msg + ": " + w.cause.Error() }
+func (w *withMessage) Cause() error  { return w.cause }
+
+func (w *withMessage) Format(s fmt.State, verb rune) {
+	switch verb {
+	case 'v':
+		if s.Flag('+') {
+			fmt.Fprintf(s, "%+v\n", w.Cause())
+			io.WriteString(s, w.msg)
+			return
+		}
+		fallthrough
+	case 's', 'q':
+		io.WriteString(s, w.Error())
+	}
+}
+
+// Cause returns the underlying cause of the error, if possible.
+// An error value has a cause if it implements the following
+// interface:
+//
+//     type causer interface {
+//            Cause() error
+//     }
+//
+// If the error does not implement Cause, the original error will
+// be returned. If the error is nil, nil will be returned without further
+// investigation.
+func Cause(err error) error {
+	type causer interface {
+		Cause() error
+	}
+
+	for err != nil {
+		cause, ok := err.(causer)
+		if !ok {
+			break
+		}
+		err = cause.Cause()
+	}
+	return err
+}
diff --git a/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/pkg/errors/stack.go b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/pkg/errors/stack.go
new file mode 100644
index 00000000..6b1f2891
--- /dev/null
+++ b/walkthroughs/tls-with-acm/src/gateway/vendor/github.com/pkg/errors/stack.go
@@ -0,0 +1,178 @@
+package errors
+
+import (
+	"fmt"
+	"io"
+	"path"
+	"runtime"
+	"strings"
+)
+
+// Frame represents a program counter inside a stack frame.
+type Frame uintptr
+
+// pc returns the program counter for this frame;
+// multiple frames may have the same PC value.
+func (f Frame) pc() uintptr { return uintptr(f) - 1 }
+
+// file returns the full path to the file that contains the
+// function for this Frame's pc.
+func (f Frame) file() string {
+	fn := runtime.FuncForPC(f.pc())
+	if fn == nil {
+		return "unknown"
+	}
+	file, _ := fn.FileLine(f.pc())
+	return file
+}
+
+// line returns the line number of source code of the
+// function for this Frame's pc.
+func (f Frame) line() int {
+	fn := runtime.FuncForPC(f.pc())
+	if fn == nil {
+		return 0
+	}
+	_, line := fn.FileLine(f.pc())
+	return line
+}
+
+// Format formats the frame according to the fmt.Formatter interface.
+//
+//    %s    source file
+//    %d    source line
+//    %n    function name
+//    %v    equivalent to %s:%d
+//
+// Format accepts flags that alter the printing of some verbs, as follows:
+//
+//    %+s   path of source file relative to the compile time GOPATH
+//    %+v   equivalent to %+s:%d
+func (f Frame) Format(s fmt.State, verb rune) {
+	switch verb {
+	case 's':
+		switch {
+		case s.Flag('+'):
+			pc := f.pc()
+			fn := runtime.FuncForPC(pc)
+			if fn == nil {
+				io.WriteString(s, "unknown")
+			} else {
+				file, _ := fn.FileLine(pc)
+				fmt.Fprintf(s, "%s\n\t%s", fn.Name(), file)
+			}
+		default:
+			io.WriteString(s, path.Base(f.file()))
+		}
+	case 'd':
+		fmt.Fprintf(s, "%d", f.line())
+	case 'n':
+		name := runtime.FuncForPC(f.pc()).Name()
+		io.WriteString(s, funcname(name))
+	case 'v':
+		f.Format(s, 's')
+		io.WriteString(s, ":")
+		f.Format(s, 'd')
+	}
+}
+
+// StackTrace is stack of Frames from innermost (newest) to outermost (oldest).
+type StackTrace []Frame
+
+func (st StackTrace) Format(s fmt.State, verb rune) {
+	switch verb {
+	case 'v':
+		switch {
+		case s.Flag('+'):
+			for _, f := range st {
+				fmt.Fprintf(s, "\n%+v", f)
+			}
+		case s.Flag('#'):
+			fmt.Fprintf(s, "%#v", []Frame(st))
+		default:
+			fmt.Fprintf(s, "%v", []Frame(st))
+		}
+	case 's':
+		fmt.Fprintf(s, "%s", []Frame(st))
+	}
+}
+
+// stack represents a stack of program counters.
+type stack []uintptr
+
+func (s *stack) Format(st fmt.State, verb rune) {
+	switch verb {
+	case 'v':
+		switch {
+		case st.Flag('+'):
+			for _, pc := range *s {
+				f := Frame(pc)
+				fmt.Fprintf(st, "\n%+v", f)
+			}
+		}
+	}
+}
+
+func (s *stack) StackTrace() StackTrace {
+	f := make([]Frame, len(*s))
+	for i := 0; i < len(f); i++ {
+		f[i] = Frame((*s)[i])
+	}
+	return f
+}
+
+func callers() *stack {
+	const depth = 32
+	var pcs [depth]uintptr
+	n := runtime.Callers(3, pcs[:])
+	var st stack = pcs[0:n]
+	return &st
+}
+
+// funcname removes the path prefix component of a function's name reported by func.Name().
+func funcname(name string) string {
+	i := strings.LastIndex(name, "/")
+	name = name[i+1:]
+	i = strings.Index(name, ".")
+	return name[i+1:]
+}
+
+func trimGOPATH(name, file string) string {
+	// Here we want to get the source file path relative to the compile time
+	// GOPATH. As of Go 1.6.x there is no direct way to know the compiled
+	// GOPATH at runtime, but we can infer the number of path segments in the
+	// GOPATH. We note that fn.Name() returns the function name qualified by
+	// the import path, which does not include the GOPATH. Thus we can trim
+	// segments from the beginning of the file path until the number of path
+	// separators remaining is one more than the number of path separators in
+	// the function name. For example, given:
+	//
+	//    GOPATH     /home/user
+	//    file       /home/user/src/pkg/sub/file.go
+	//    fn.Name()  pkg/sub.Type.Method
+	//
+	// We want to produce:
+	//
+	//    pkg/sub/file.go
+	//
+	// From this we can easily see that fn.Name() has one less path separator
+	// than our desired output. We count separators from the end of the file
+	// path until it finds two more than in the function name and then move
+	// one character forward to preserve the initial path segment without a
+	// leading separator.
+	const sep = "/"
+	goal := strings.Count(name, sep) + 2
+	i := len(file)
+	for n := 0; n < goal; n++ {
+		i = strings.LastIndex(file[:i], sep)
+		if i == -1 {
+			// not enough separators found, set i so that the slice expression
+			// below leaves file unmodified
+			i = -len(sep)
+			break
+		}
+	}
+	// get back to 0 or trim the leading separator
+	file = file[i+len(sep):]
+	return file
+}