From c537c00a1264bc3963fee835f4d39bc6c02b851c Mon Sep 17 00:00:00 2001
From: awstools <awstools@amazon.com>
Date: Fri, 24 Feb 2023 19:15:02 +0000
Subject: [PATCH] feat(client-securityhub): New Security Hub APIs and updates
 to existing APIs that help you consolidate control findings and enable and
 disable controls across all supported standards

---
 clients/client-securityhub/README.md          |   31 +-
 clients/client-securityhub/src/SecurityHub.ts |  228 ++-
 .../src/SecurityHubClient.ts                  |   61 +-
 .../BatchGetSecurityControlsCommand.ts        |  116 ++
 ...hGetStandardsControlAssociationsCommand.ts |  124 ++
 ...dateStandardsControlAssociationsCommand.ts |  131 ++
 .../DeleteFindingAggregatorCommand.ts         |    2 +-
 .../src/commands/DeleteInsightCommand.ts      |    2 +-
 .../src/commands/DeleteInvitationsCommand.ts  |    2 +-
 .../src/commands/DeleteMembersCommand.ts      |    2 +-
 .../commands/DescribeActionTargetsCommand.ts  |    2 +-
 .../src/commands/DescribeHubCommand.ts        |    2 +-
 ...escribeOrganizationConfigurationCommand.ts |    2 +-
 .../src/commands/DescribeProductsCommand.ts   |    8 +-
 .../ListSecurityControlDefinitionsCommand.ts  |  124 ++
 ...ListStandardsControlAssociationsCommand.ts |  124 ++
 .../client-securityhub/src/commands/index.ts  |    5 +
 .../client-securityhub/src/models/models_0.ts |   48 +-
 .../client-securityhub/src/models/models_1.ts |  736 ++++++----
 .../client-securityhub/src/models/models_2.ts |  662 ++++++++-
 ...ListSecurityControlDefinitionsPaginator.ts |   61 +
 ...stStandardsControlAssociationsPaginator.ts |   61 +
 .../src/pagination/index.ts                   |    2 +
 .../src/protocols/Aws_restJson1.ts            |  798 ++++++++++-
 .../sdk-codegen/aws-models/securityhub.json   | 1276 ++++++++++++++---
 25 files changed, 4002 insertions(+), 608 deletions(-)
 create mode 100644 clients/client-securityhub/src/commands/BatchGetSecurityControlsCommand.ts
 create mode 100644 clients/client-securityhub/src/commands/BatchGetStandardsControlAssociationsCommand.ts
 create mode 100644 clients/client-securityhub/src/commands/BatchUpdateStandardsControlAssociationsCommand.ts
 create mode 100644 clients/client-securityhub/src/commands/ListSecurityControlDefinitionsCommand.ts
 create mode 100644 clients/client-securityhub/src/commands/ListStandardsControlAssociationsCommand.ts
 create mode 100644 clients/client-securityhub/src/pagination/ListSecurityControlDefinitionsPaginator.ts
 create mode 100644 clients/client-securityhub/src/pagination/ListStandardsControlAssociationsPaginator.ts

diff --git a/clients/client-securityhub/README.md b/clients/client-securityhub/README.md
index 9d9cb3e7df3a..5271ac96e5c4 100644
--- a/clients/client-securityhub/README.md
+++ b/clients/client-securityhub/README.md
@@ -9,19 +9,16 @@
 
 AWS SDK for JavaScript SecurityHub Client for Node.js, Browser and React Native.
 
-<p>Security Hub provides you with a comprehensive view of the security state of your Amazon Web Services environment and resources. It also provides you with the readiness status
-of your environment based on controls from supported security standards. Security Hub collects
-security data from Amazon Web Services accounts, services, and integrated third-party products and helps
-you analyze security trends in your environment to identify the highest priority security
-issues. For more information about Security Hub, see the <a href="https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html">
-<i>Security HubUser
-Guide</i>
-</a>.</p>
-<p>When you use operations in the Security Hub API, the requests are executed only in the Amazon Web Services
-Region that is currently active or in the specific Amazon Web Services Region that you specify in your
-request. Any configuration or settings change that results from the operation is applied
-only to that Region. To make the same change in other Regions, execute the same command for
-each Region to apply the change to.</p>
+<p>Security Hub provides you with a comprehensive view of the security state of
+your Amazon Web Services environment and resources. It also provides you with the readiness
+status of your environment based on controls from supported security standards. Security Hub collects security data from Amazon Web Services accounts, services, and
+integrated third-party products and helps you analyze security trends in your environment
+to identify the highest priority security issues. For more information about Security Hub, see the <a href="https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html">Security HubUser
+Guide</a>.</p>
+<p>When you use operations in the Security Hub API, the requests are executed only in
+the Amazon Web Services Region that is currently active or in the specific Amazon Web Services Region that you specify in your request. Any configuration or settings change
+that results from the operation is applied only to that Region. To make the same change in
+other Regions, run the same command for each Region in which you want to apply the change.</p>
 <p>For example, if your Region is set to <code>us-west-2</code>, when you use <code>CreateMembers</code> to add a member account to Security Hub, the association of
 the member account with the administrator account is created only in the <code>us-west-2</code>
 Region. Security Hub must be enabled for the member account in the same Region that the invitation
@@ -30,8 +27,8 @@ was sent from.</p>
 <ul>
 <li>
 <p>
-<code>BatchEnableStandards</code> - <code>RateLimit</code> of 1
-request per second, <code>BurstLimit</code> of 1 request per second.</p>
+<code>BatchEnableStandards</code> - <code>RateLimit</code> of 1 request per
+second. <code>BurstLimit</code> of 1 request per second.</p>
 </li>
 <li>
 <p>
@@ -50,8 +47,8 @@ request per second, <code>BurstLimit</code> of 1 request per second.</p>
 </li>
 <li>
 <p>
-<code>UpdateStandardsControl</code> - <code>RateLimit</code> of
-1 request per second, <code>BurstLimit</code> of 5 requests per second.</p>
+<code>UpdateStandardsControl</code> - <code>RateLimit</code> of 1 request per
+second. <code>BurstLimit</code> of 5 requests per second.</p>
 </li>
 <li>
 <p>All other operations - <code>RateLimit</code> of 10 requests per second.
diff --git a/clients/client-securityhub/src/SecurityHub.ts b/clients/client-securityhub/src/SecurityHub.ts
index 874349655cda..b2bb628c09e1 100644
--- a/clients/client-securityhub/src/SecurityHub.ts
+++ b/clients/client-securityhub/src/SecurityHub.ts
@@ -21,6 +21,16 @@ import {
   BatchEnableStandardsCommandInput,
   BatchEnableStandardsCommandOutput,
 } from "./commands/BatchEnableStandardsCommand";
+import {
+  BatchGetSecurityControlsCommand,
+  BatchGetSecurityControlsCommandInput,
+  BatchGetSecurityControlsCommandOutput,
+} from "./commands/BatchGetSecurityControlsCommand";
+import {
+  BatchGetStandardsControlAssociationsCommand,
+  BatchGetStandardsControlAssociationsCommandInput,
+  BatchGetStandardsControlAssociationsCommandOutput,
+} from "./commands/BatchGetStandardsControlAssociationsCommand";
 import {
   BatchImportFindingsCommand,
   BatchImportFindingsCommandInput,
@@ -31,6 +41,11 @@ import {
   BatchUpdateFindingsCommandInput,
   BatchUpdateFindingsCommandOutput,
 } from "./commands/BatchUpdateFindingsCommand";
+import {
+  BatchUpdateStandardsControlAssociationsCommand,
+  BatchUpdateStandardsControlAssociationsCommandInput,
+  BatchUpdateStandardsControlAssociationsCommandOutput,
+} from "./commands/BatchUpdateStandardsControlAssociationsCommand";
 import {
   CreateActionTargetCommand,
   CreateActionTargetCommandInput,
@@ -211,6 +226,16 @@ import {
   ListOrganizationAdminAccountsCommandInput,
   ListOrganizationAdminAccountsCommandOutput,
 } from "./commands/ListOrganizationAdminAccountsCommand";
+import {
+  ListSecurityControlDefinitionsCommand,
+  ListSecurityControlDefinitionsCommandInput,
+  ListSecurityControlDefinitionsCommandOutput,
+} from "./commands/ListSecurityControlDefinitionsCommand";
+import {
+  ListStandardsControlAssociationsCommand,
+  ListStandardsControlAssociationsCommandInput,
+  ListStandardsControlAssociationsCommandOutput,
+} from "./commands/ListStandardsControlAssociationsCommand";
 import {
   ListTagsForResourceCommand,
   ListTagsForResourceCommandInput,
@@ -260,19 +285,16 @@ import {
 import { SecurityHubClient } from "./SecurityHubClient";
 
 /**
- * <p>Security Hub provides you with a comprehensive view of the security state of your Amazon Web Services environment and resources. It also provides you with the readiness status
- *          of your environment based on controls from supported security standards. Security Hub collects
- *          security data from Amazon Web Services accounts, services, and integrated third-party products and helps
- *          you analyze security trends in your environment to identify the highest priority security
- *          issues. For more information about Security Hub, see the <a href="https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html">
- *                <i>Security HubUser
- *             Guide</i>
- *             </a>.</p>
- *          <p>When you use operations in the Security Hub API, the requests are executed only in the Amazon Web Services
- *          Region that is currently active or in the specific Amazon Web Services Region that you specify in your
- *          request. Any configuration or settings change that results from the operation is applied
- *          only to that Region. To make the same change in other Regions, execute the same command for
- *          each Region to apply the change to.</p>
+ * <p>Security Hub provides you with a comprehensive view of the security state of
+ *          your Amazon Web Services environment and resources. It also provides you with the readiness
+ *          status of your environment based on controls from supported security standards. Security Hub collects security data from Amazon Web Services accounts, services, and
+ *          integrated third-party products and helps you analyze security trends in your environment
+ *          to identify the highest priority security issues. For more information about Security Hub, see the <a href="https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html">Security HubUser
+ *             Guide</a>.</p>
+ *          <p>When you use operations in the Security Hub API, the requests are executed only in
+ *          the Amazon Web Services Region that is currently active or in the specific Amazon Web Services Region that you specify in your request. Any configuration or settings change
+ *          that results from the operation is applied only to that Region. To make the same change in
+ *          other Regions, run the same command for each Region in which you want to apply the change.</p>
  *          <p>For example, if your Region is set to <code>us-west-2</code>, when you use <code>CreateMembers</code> to add a member account to Security Hub, the association of
  *          the member account with the administrator account is created only in the <code>us-west-2</code>
  *          Region. Security Hub must be enabled for the member account in the same Region that the invitation
@@ -281,8 +303,8 @@ import { SecurityHubClient } from "./SecurityHubClient";
  *          <ul>
  *             <li>
  *                <p>
- *                   <code>BatchEnableStandards</code> - <code>RateLimit</code> of 1
- *                request per second, <code>BurstLimit</code> of 1 request per second.</p>
+ *                   <code>BatchEnableStandards</code> - <code>RateLimit</code> of 1 request per
+ *                second. <code>BurstLimit</code> of 1 request per second.</p>
  *             </li>
  *             <li>
  *                <p>
@@ -301,8 +323,8 @@ import { SecurityHubClient } from "./SecurityHubClient";
  *             </li>
  *             <li>
  *                <p>
- *                   <code>UpdateStandardsControl</code> - <code>RateLimit</code> of
- *                1 request per second, <code>BurstLimit</code> of 5 requests per second.</p>
+ *                   <code>UpdateStandardsControl</code> - <code>RateLimit</code> of 1 request per
+ *                second. <code>BurstLimit</code> of 5 requests per second.</p>
  *             </li>
  *             <li>
  *                <p>All other operations - <code>RateLimit</code> of 10 requests per second.
@@ -460,6 +482,74 @@ export class SecurityHub extends SecurityHubClient {
     }
   }
 
+  /**
+   * <p>
+   *          Provides details about a batch of security controls for the current Amazon Web Services account and Amazon Web Services Region.
+   *       </p>
+   */
+  public batchGetSecurityControls(
+    args: BatchGetSecurityControlsCommandInput,
+    options?: __HttpHandlerOptions
+  ): Promise<BatchGetSecurityControlsCommandOutput>;
+  public batchGetSecurityControls(
+    args: BatchGetSecurityControlsCommandInput,
+    cb: (err: any, data?: BatchGetSecurityControlsCommandOutput) => void
+  ): void;
+  public batchGetSecurityControls(
+    args: BatchGetSecurityControlsCommandInput,
+    options: __HttpHandlerOptions,
+    cb: (err: any, data?: BatchGetSecurityControlsCommandOutput) => void
+  ): void;
+  public batchGetSecurityControls(
+    args: BatchGetSecurityControlsCommandInput,
+    optionsOrCb?: __HttpHandlerOptions | ((err: any, data?: BatchGetSecurityControlsCommandOutput) => void),
+    cb?: (err: any, data?: BatchGetSecurityControlsCommandOutput) => void
+  ): Promise<BatchGetSecurityControlsCommandOutput> | void {
+    const command = new BatchGetSecurityControlsCommand(args);
+    if (typeof optionsOrCb === "function") {
+      this.send(command, optionsOrCb);
+    } else if (typeof cb === "function") {
+      if (typeof optionsOrCb !== "object") throw new Error(`Expect http options but get ${typeof optionsOrCb}`);
+      this.send(command, optionsOrCb || {}, cb);
+    } else {
+      return this.send(command, optionsOrCb);
+    }
+  }
+
+  /**
+   * <p>
+   *          For a batch of security controls and standards, identifies whether each control is currently enabled or disabled in a standard.
+   *       </p>
+   */
+  public batchGetStandardsControlAssociations(
+    args: BatchGetStandardsControlAssociationsCommandInput,
+    options?: __HttpHandlerOptions
+  ): Promise<BatchGetStandardsControlAssociationsCommandOutput>;
+  public batchGetStandardsControlAssociations(
+    args: BatchGetStandardsControlAssociationsCommandInput,
+    cb: (err: any, data?: BatchGetStandardsControlAssociationsCommandOutput) => void
+  ): void;
+  public batchGetStandardsControlAssociations(
+    args: BatchGetStandardsControlAssociationsCommandInput,
+    options: __HttpHandlerOptions,
+    cb: (err: any, data?: BatchGetStandardsControlAssociationsCommandOutput) => void
+  ): void;
+  public batchGetStandardsControlAssociations(
+    args: BatchGetStandardsControlAssociationsCommandInput,
+    optionsOrCb?: __HttpHandlerOptions | ((err: any, data?: BatchGetStandardsControlAssociationsCommandOutput) => void),
+    cb?: (err: any, data?: BatchGetStandardsControlAssociationsCommandOutput) => void
+  ): Promise<BatchGetStandardsControlAssociationsCommandOutput> | void {
+    const command = new BatchGetStandardsControlAssociationsCommand(args);
+    if (typeof optionsOrCb === "function") {
+      this.send(command, optionsOrCb);
+    } else if (typeof cb === "function") {
+      if (typeof optionsOrCb !== "object") throw new Error(`Expect http options but get ${typeof optionsOrCb}`);
+      this.send(command, optionsOrCb || {}, cb);
+    } else {
+      return this.send(command, optionsOrCb);
+    }
+  }
+
   /**
    * <p>Imports security findings generated by a finding provider into Security Hub.
    *          This action is requested by the finding provider to import its findings into
@@ -656,6 +746,42 @@ export class SecurityHub extends SecurityHubClient {
     }
   }
 
+  /**
+   * <p>
+   *          For a batch of security controls and standards, this operation updates the enablement status of a control in a standard.
+   *       </p>
+   */
+  public batchUpdateStandardsControlAssociations(
+    args: BatchUpdateStandardsControlAssociationsCommandInput,
+    options?: __HttpHandlerOptions
+  ): Promise<BatchUpdateStandardsControlAssociationsCommandOutput>;
+  public batchUpdateStandardsControlAssociations(
+    args: BatchUpdateStandardsControlAssociationsCommandInput,
+    cb: (err: any, data?: BatchUpdateStandardsControlAssociationsCommandOutput) => void
+  ): void;
+  public batchUpdateStandardsControlAssociations(
+    args: BatchUpdateStandardsControlAssociationsCommandInput,
+    options: __HttpHandlerOptions,
+    cb: (err: any, data?: BatchUpdateStandardsControlAssociationsCommandOutput) => void
+  ): void;
+  public batchUpdateStandardsControlAssociations(
+    args: BatchUpdateStandardsControlAssociationsCommandInput,
+    optionsOrCb?:
+      | __HttpHandlerOptions
+      | ((err: any, data?: BatchUpdateStandardsControlAssociationsCommandOutput) => void),
+    cb?: (err: any, data?: BatchUpdateStandardsControlAssociationsCommandOutput) => void
+  ): Promise<BatchUpdateStandardsControlAssociationsCommandOutput> | void {
+    const command = new BatchUpdateStandardsControlAssociationsCommand(args);
+    if (typeof optionsOrCb === "function") {
+      this.send(command, optionsOrCb);
+    } else if (typeof cb === "function") {
+      if (typeof optionsOrCb !== "object") throw new Error(`Expect http options but get ${typeof optionsOrCb}`);
+      this.send(command, optionsOrCb || {}, cb);
+    } else {
+      return this.send(command, optionsOrCb);
+    }
+  }
+
   /**
    * <p>Creates a custom action target in Security Hub.</p>
    *          <p>You can use custom actions on findings and insights in Security Hub to trigger target actions
@@ -2040,6 +2166,74 @@ export class SecurityHub extends SecurityHubClient {
     }
   }
 
+  /**
+   * <p>
+   *          Lists all of the security controls that apply to a specified standard.
+   *       </p>
+   */
+  public listSecurityControlDefinitions(
+    args: ListSecurityControlDefinitionsCommandInput,
+    options?: __HttpHandlerOptions
+  ): Promise<ListSecurityControlDefinitionsCommandOutput>;
+  public listSecurityControlDefinitions(
+    args: ListSecurityControlDefinitionsCommandInput,
+    cb: (err: any, data?: ListSecurityControlDefinitionsCommandOutput) => void
+  ): void;
+  public listSecurityControlDefinitions(
+    args: ListSecurityControlDefinitionsCommandInput,
+    options: __HttpHandlerOptions,
+    cb: (err: any, data?: ListSecurityControlDefinitionsCommandOutput) => void
+  ): void;
+  public listSecurityControlDefinitions(
+    args: ListSecurityControlDefinitionsCommandInput,
+    optionsOrCb?: __HttpHandlerOptions | ((err: any, data?: ListSecurityControlDefinitionsCommandOutput) => void),
+    cb?: (err: any, data?: ListSecurityControlDefinitionsCommandOutput) => void
+  ): Promise<ListSecurityControlDefinitionsCommandOutput> | void {
+    const command = new ListSecurityControlDefinitionsCommand(args);
+    if (typeof optionsOrCb === "function") {
+      this.send(command, optionsOrCb);
+    } else if (typeof cb === "function") {
+      if (typeof optionsOrCb !== "object") throw new Error(`Expect http options but get ${typeof optionsOrCb}`);
+      this.send(command, optionsOrCb || {}, cb);
+    } else {
+      return this.send(command, optionsOrCb);
+    }
+  }
+
+  /**
+   * <p>
+   *          Specifies whether a control is currently enabled or disabled in each enabled standard in the calling account.
+   *       </p>
+   */
+  public listStandardsControlAssociations(
+    args: ListStandardsControlAssociationsCommandInput,
+    options?: __HttpHandlerOptions
+  ): Promise<ListStandardsControlAssociationsCommandOutput>;
+  public listStandardsControlAssociations(
+    args: ListStandardsControlAssociationsCommandInput,
+    cb: (err: any, data?: ListStandardsControlAssociationsCommandOutput) => void
+  ): void;
+  public listStandardsControlAssociations(
+    args: ListStandardsControlAssociationsCommandInput,
+    options: __HttpHandlerOptions,
+    cb: (err: any, data?: ListStandardsControlAssociationsCommandOutput) => void
+  ): void;
+  public listStandardsControlAssociations(
+    args: ListStandardsControlAssociationsCommandInput,
+    optionsOrCb?: __HttpHandlerOptions | ((err: any, data?: ListStandardsControlAssociationsCommandOutput) => void),
+    cb?: (err: any, data?: ListStandardsControlAssociationsCommandOutput) => void
+  ): Promise<ListStandardsControlAssociationsCommandOutput> | void {
+    const command = new ListStandardsControlAssociationsCommand(args);
+    if (typeof optionsOrCb === "function") {
+      this.send(command, optionsOrCb);
+    } else if (typeof cb === "function") {
+      if (typeof optionsOrCb !== "object") throw new Error(`Expect http options but get ${typeof optionsOrCb}`);
+      this.send(command, optionsOrCb || {}, cb);
+    } else {
+      return this.send(command, optionsOrCb);
+    }
+  }
+
   /**
    * <p>Returns a list of tags associated with a resource.</p>
    */
diff --git a/clients/client-securityhub/src/SecurityHubClient.ts b/clients/client-securityhub/src/SecurityHubClient.ts
index 4c33bb3c8ca4..df0cde2b7e4b 100644
--- a/clients/client-securityhub/src/SecurityHubClient.ts
+++ b/clients/client-securityhub/src/SecurityHubClient.ts
@@ -62,6 +62,14 @@ import {
   BatchEnableStandardsCommandInput,
   BatchEnableStandardsCommandOutput,
 } from "./commands/BatchEnableStandardsCommand";
+import {
+  BatchGetSecurityControlsCommandInput,
+  BatchGetSecurityControlsCommandOutput,
+} from "./commands/BatchGetSecurityControlsCommand";
+import {
+  BatchGetStandardsControlAssociationsCommandInput,
+  BatchGetStandardsControlAssociationsCommandOutput,
+} from "./commands/BatchGetStandardsControlAssociationsCommand";
 import {
   BatchImportFindingsCommandInput,
   BatchImportFindingsCommandOutput,
@@ -70,6 +78,10 @@ import {
   BatchUpdateFindingsCommandInput,
   BatchUpdateFindingsCommandOutput,
 } from "./commands/BatchUpdateFindingsCommand";
+import {
+  BatchUpdateStandardsControlAssociationsCommandInput,
+  BatchUpdateStandardsControlAssociationsCommandOutput,
+} from "./commands/BatchUpdateStandardsControlAssociationsCommand";
 import { CreateActionTargetCommandInput, CreateActionTargetCommandOutput } from "./commands/CreateActionTargetCommand";
 import {
   CreateFindingAggregatorCommandInput,
@@ -167,6 +179,14 @@ import {
   ListOrganizationAdminAccountsCommandInput,
   ListOrganizationAdminAccountsCommandOutput,
 } from "./commands/ListOrganizationAdminAccountsCommand";
+import {
+  ListSecurityControlDefinitionsCommandInput,
+  ListSecurityControlDefinitionsCommandOutput,
+} from "./commands/ListSecurityControlDefinitionsCommand";
+import {
+  ListStandardsControlAssociationsCommandInput,
+  ListStandardsControlAssociationsCommandOutput,
+} from "./commands/ListStandardsControlAssociationsCommand";
 import {
   ListTagsForResourceCommandInput,
   ListTagsForResourceCommandOutput,
@@ -205,8 +225,11 @@ export type ServiceInputTypes =
   | AcceptInvitationCommandInput
   | BatchDisableStandardsCommandInput
   | BatchEnableStandardsCommandInput
+  | BatchGetSecurityControlsCommandInput
+  | BatchGetStandardsControlAssociationsCommandInput
   | BatchImportFindingsCommandInput
   | BatchUpdateFindingsCommandInput
+  | BatchUpdateStandardsControlAssociationsCommandInput
   | CreateActionTargetCommandInput
   | CreateFindingAggregatorCommandInput
   | CreateInsightCommandInput
@@ -247,6 +270,8 @@ export type ServiceInputTypes =
   | ListInvitationsCommandInput
   | ListMembersCommandInput
   | ListOrganizationAdminAccountsCommandInput
+  | ListSecurityControlDefinitionsCommandInput
+  | ListStandardsControlAssociationsCommandInput
   | ListTagsForResourceCommandInput
   | TagResourceCommandInput
   | UntagResourceCommandInput
@@ -263,8 +288,11 @@ export type ServiceOutputTypes =
   | AcceptInvitationCommandOutput
   | BatchDisableStandardsCommandOutput
   | BatchEnableStandardsCommandOutput
+  | BatchGetSecurityControlsCommandOutput
+  | BatchGetStandardsControlAssociationsCommandOutput
   | BatchImportFindingsCommandOutput
   | BatchUpdateFindingsCommandOutput
+  | BatchUpdateStandardsControlAssociationsCommandOutput
   | CreateActionTargetCommandOutput
   | CreateFindingAggregatorCommandOutput
   | CreateInsightCommandOutput
@@ -305,6 +333,8 @@ export type ServiceOutputTypes =
   | ListInvitationsCommandOutput
   | ListMembersCommandOutput
   | ListOrganizationAdminAccountsCommandOutput
+  | ListSecurityControlDefinitionsCommandOutput
+  | ListStandardsControlAssociationsCommandOutput
   | ListTagsForResourceCommandOutput
   | TagResourceCommandOutput
   | UntagResourceCommandOutput
@@ -466,19 +496,16 @@ type SecurityHubClientResolvedConfigType = __SmithyResolvedConfiguration<__HttpH
 export interface SecurityHubClientResolvedConfig extends SecurityHubClientResolvedConfigType {}
 
 /**
- * <p>Security Hub provides you with a comprehensive view of the security state of your Amazon Web Services environment and resources. It also provides you with the readiness status
- *          of your environment based on controls from supported security standards. Security Hub collects
- *          security data from Amazon Web Services accounts, services, and integrated third-party products and helps
- *          you analyze security trends in your environment to identify the highest priority security
- *          issues. For more information about Security Hub, see the <a href="https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html">
- *                <i>Security HubUser
- *             Guide</i>
- *             </a>.</p>
- *          <p>When you use operations in the Security Hub API, the requests are executed only in the Amazon Web Services
- *          Region that is currently active or in the specific Amazon Web Services Region that you specify in your
- *          request. Any configuration or settings change that results from the operation is applied
- *          only to that Region. To make the same change in other Regions, execute the same command for
- *          each Region to apply the change to.</p>
+ * <p>Security Hub provides you with a comprehensive view of the security state of
+ *          your Amazon Web Services environment and resources. It also provides you with the readiness
+ *          status of your environment based on controls from supported security standards. Security Hub collects security data from Amazon Web Services accounts, services, and
+ *          integrated third-party products and helps you analyze security trends in your environment
+ *          to identify the highest priority security issues. For more information about Security Hub, see the <a href="https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html">Security HubUser
+ *             Guide</a>.</p>
+ *          <p>When you use operations in the Security Hub API, the requests are executed only in
+ *          the Amazon Web Services Region that is currently active or in the specific Amazon Web Services Region that you specify in your request. Any configuration or settings change
+ *          that results from the operation is applied only to that Region. To make the same change in
+ *          other Regions, run the same command for each Region in which you want to apply the change.</p>
  *          <p>For example, if your Region is set to <code>us-west-2</code>, when you use <code>CreateMembers</code> to add a member account to Security Hub, the association of
  *          the member account with the administrator account is created only in the <code>us-west-2</code>
  *          Region. Security Hub must be enabled for the member account in the same Region that the invitation
@@ -487,8 +514,8 @@ export interface SecurityHubClientResolvedConfig extends SecurityHubClientResolv
  *          <ul>
  *             <li>
  *                <p>
- *                   <code>BatchEnableStandards</code> - <code>RateLimit</code> of 1
- *                request per second, <code>BurstLimit</code> of 1 request per second.</p>
+ *                   <code>BatchEnableStandards</code> - <code>RateLimit</code> of 1 request per
+ *                second. <code>BurstLimit</code> of 1 request per second.</p>
  *             </li>
  *             <li>
  *                <p>
@@ -507,8 +534,8 @@ export interface SecurityHubClientResolvedConfig extends SecurityHubClientResolv
  *             </li>
  *             <li>
  *                <p>
- *                   <code>UpdateStandardsControl</code> - <code>RateLimit</code> of
- *                1 request per second, <code>BurstLimit</code> of 5 requests per second.</p>
+ *                   <code>UpdateStandardsControl</code> - <code>RateLimit</code> of 1 request per
+ *                second. <code>BurstLimit</code> of 5 requests per second.</p>
  *             </li>
  *             <li>
  *                <p>All other operations - <code>RateLimit</code> of 10 requests per second.
diff --git a/clients/client-securityhub/src/commands/BatchGetSecurityControlsCommand.ts b/clients/client-securityhub/src/commands/BatchGetSecurityControlsCommand.ts
new file mode 100644
index 000000000000..74ec1c20da7d
--- /dev/null
+++ b/clients/client-securityhub/src/commands/BatchGetSecurityControlsCommand.ts
@@ -0,0 +1,116 @@
+// smithy-typescript generated code
+import { EndpointParameterInstructions, getEndpointPlugin } from "@aws-sdk/middleware-endpoint";
+import { getSerdePlugin } from "@aws-sdk/middleware-serde";
+import { HttpRequest as __HttpRequest, HttpResponse as __HttpResponse } from "@aws-sdk/protocol-http";
+import { Command as $Command } from "@aws-sdk/smithy-client";
+import {
+  FinalizeHandlerArguments,
+  Handler,
+  HandlerExecutionContext,
+  HttpHandlerOptions as __HttpHandlerOptions,
+  MetadataBearer as __MetadataBearer,
+  MiddlewareStack,
+  SerdeContext as __SerdeContext,
+} from "@aws-sdk/types";
+
+import {
+  BatchGetSecurityControlsRequest,
+  BatchGetSecurityControlsRequestFilterSensitiveLog,
+  BatchGetSecurityControlsResponse,
+  BatchGetSecurityControlsResponseFilterSensitiveLog,
+} from "../models/models_1";
+import {
+  deserializeAws_restJson1BatchGetSecurityControlsCommand,
+  serializeAws_restJson1BatchGetSecurityControlsCommand,
+} from "../protocols/Aws_restJson1";
+import { SecurityHubClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes } from "../SecurityHubClient";
+
+export interface BatchGetSecurityControlsCommandInput extends BatchGetSecurityControlsRequest {}
+export interface BatchGetSecurityControlsCommandOutput extends BatchGetSecurityControlsResponse, __MetadataBearer {}
+
+/**
+ * <p>
+ *          Provides details about a batch of security controls for the current Amazon Web Services account and Amazon Web Services Region.
+ *       </p>
+ * @example
+ * Use a bare-bones client and the command you need to make an API call.
+ * ```javascript
+ * import { SecurityHubClient, BatchGetSecurityControlsCommand } from "@aws-sdk/client-securityhub"; // ES Modules import
+ * // const { SecurityHubClient, BatchGetSecurityControlsCommand } = require("@aws-sdk/client-securityhub"); // CommonJS import
+ * const client = new SecurityHubClient(config);
+ * const command = new BatchGetSecurityControlsCommand(input);
+ * const response = await client.send(command);
+ * ```
+ *
+ * @see {@link BatchGetSecurityControlsCommandInput} for command's `input` shape.
+ * @see {@link BatchGetSecurityControlsCommandOutput} for command's `response` shape.
+ * @see {@link SecurityHubClientResolvedConfig | config} for SecurityHubClient's `config` shape.
+ *
+ */
+export class BatchGetSecurityControlsCommand extends $Command<
+  BatchGetSecurityControlsCommandInput,
+  BatchGetSecurityControlsCommandOutput,
+  SecurityHubClientResolvedConfig
+> {
+  // Start section: command_properties
+  // End section: command_properties
+
+  public static getEndpointParameterInstructions(): EndpointParameterInstructions {
+    return {
+      UseFIPS: { type: "builtInParams", name: "useFipsEndpoint" },
+      Endpoint: { type: "builtInParams", name: "endpoint" },
+      Region: { type: "builtInParams", name: "region" },
+      UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" },
+    };
+  }
+
+  constructor(readonly input: BatchGetSecurityControlsCommandInput) {
+    // Start section: command_constructor
+    super();
+    // End section: command_constructor
+  }
+
+  /**
+   * @internal
+   */
+  resolveMiddleware(
+    clientStack: MiddlewareStack<ServiceInputTypes, ServiceOutputTypes>,
+    configuration: SecurityHubClientResolvedConfig,
+    options?: __HttpHandlerOptions
+  ): Handler<BatchGetSecurityControlsCommandInput, BatchGetSecurityControlsCommandOutput> {
+    this.middlewareStack.use(getSerdePlugin(configuration, this.serialize, this.deserialize));
+    this.middlewareStack.use(
+      getEndpointPlugin(configuration, BatchGetSecurityControlsCommand.getEndpointParameterInstructions())
+    );
+
+    const stack = clientStack.concat(this.middlewareStack);
+
+    const { logger } = configuration;
+    const clientName = "SecurityHubClient";
+    const commandName = "BatchGetSecurityControlsCommand";
+    const handlerExecutionContext: HandlerExecutionContext = {
+      logger,
+      clientName,
+      commandName,
+      inputFilterSensitiveLog: BatchGetSecurityControlsRequestFilterSensitiveLog,
+      outputFilterSensitiveLog: BatchGetSecurityControlsResponseFilterSensitiveLog,
+    };
+    const { requestHandler } = configuration;
+    return stack.resolve(
+      (request: FinalizeHandlerArguments<any>) =>
+        requestHandler.handle(request.request as __HttpRequest, options || {}),
+      handlerExecutionContext
+    );
+  }
+
+  private serialize(input: BatchGetSecurityControlsCommandInput, context: __SerdeContext): Promise<__HttpRequest> {
+    return serializeAws_restJson1BatchGetSecurityControlsCommand(input, context);
+  }
+
+  private deserialize(output: __HttpResponse, context: __SerdeContext): Promise<BatchGetSecurityControlsCommandOutput> {
+    return deserializeAws_restJson1BatchGetSecurityControlsCommand(output, context);
+  }
+
+  // Start section: command_body_extra
+  // End section: command_body_extra
+}
diff --git a/clients/client-securityhub/src/commands/BatchGetStandardsControlAssociationsCommand.ts b/clients/client-securityhub/src/commands/BatchGetStandardsControlAssociationsCommand.ts
new file mode 100644
index 000000000000..5eb9dc767c48
--- /dev/null
+++ b/clients/client-securityhub/src/commands/BatchGetStandardsControlAssociationsCommand.ts
@@ -0,0 +1,124 @@
+// smithy-typescript generated code
+import { EndpointParameterInstructions, getEndpointPlugin } from "@aws-sdk/middleware-endpoint";
+import { getSerdePlugin } from "@aws-sdk/middleware-serde";
+import { HttpRequest as __HttpRequest, HttpResponse as __HttpResponse } from "@aws-sdk/protocol-http";
+import { Command as $Command } from "@aws-sdk/smithy-client";
+import {
+  FinalizeHandlerArguments,
+  Handler,
+  HandlerExecutionContext,
+  HttpHandlerOptions as __HttpHandlerOptions,
+  MetadataBearer as __MetadataBearer,
+  MiddlewareStack,
+  SerdeContext as __SerdeContext,
+} from "@aws-sdk/types";
+
+import {
+  BatchGetStandardsControlAssociationsRequest,
+  BatchGetStandardsControlAssociationsRequestFilterSensitiveLog,
+  BatchGetStandardsControlAssociationsResponse,
+  BatchGetStandardsControlAssociationsResponseFilterSensitiveLog,
+} from "../models/models_1";
+import {
+  deserializeAws_restJson1BatchGetStandardsControlAssociationsCommand,
+  serializeAws_restJson1BatchGetStandardsControlAssociationsCommand,
+} from "../protocols/Aws_restJson1";
+import { SecurityHubClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes } from "../SecurityHubClient";
+
+export interface BatchGetStandardsControlAssociationsCommandInput extends BatchGetStandardsControlAssociationsRequest {}
+export interface BatchGetStandardsControlAssociationsCommandOutput
+  extends BatchGetStandardsControlAssociationsResponse,
+    __MetadataBearer {}
+
+/**
+ * <p>
+ *          For a batch of security controls and standards, identifies whether each control is currently enabled or disabled in a standard.
+ *       </p>
+ * @example
+ * Use a bare-bones client and the command you need to make an API call.
+ * ```javascript
+ * import { SecurityHubClient, BatchGetStandardsControlAssociationsCommand } from "@aws-sdk/client-securityhub"; // ES Modules import
+ * // const { SecurityHubClient, BatchGetStandardsControlAssociationsCommand } = require("@aws-sdk/client-securityhub"); // CommonJS import
+ * const client = new SecurityHubClient(config);
+ * const command = new BatchGetStandardsControlAssociationsCommand(input);
+ * const response = await client.send(command);
+ * ```
+ *
+ * @see {@link BatchGetStandardsControlAssociationsCommandInput} for command's `input` shape.
+ * @see {@link BatchGetStandardsControlAssociationsCommandOutput} for command's `response` shape.
+ * @see {@link SecurityHubClientResolvedConfig | config} for SecurityHubClient's `config` shape.
+ *
+ */
+export class BatchGetStandardsControlAssociationsCommand extends $Command<
+  BatchGetStandardsControlAssociationsCommandInput,
+  BatchGetStandardsControlAssociationsCommandOutput,
+  SecurityHubClientResolvedConfig
+> {
+  // Start section: command_properties
+  // End section: command_properties
+
+  public static getEndpointParameterInstructions(): EndpointParameterInstructions {
+    return {
+      UseFIPS: { type: "builtInParams", name: "useFipsEndpoint" },
+      Endpoint: { type: "builtInParams", name: "endpoint" },
+      Region: { type: "builtInParams", name: "region" },
+      UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" },
+    };
+  }
+
+  constructor(readonly input: BatchGetStandardsControlAssociationsCommandInput) {
+    // Start section: command_constructor
+    super();
+    // End section: command_constructor
+  }
+
+  /**
+   * @internal
+   */
+  resolveMiddleware(
+    clientStack: MiddlewareStack<ServiceInputTypes, ServiceOutputTypes>,
+    configuration: SecurityHubClientResolvedConfig,
+    options?: __HttpHandlerOptions
+  ): Handler<BatchGetStandardsControlAssociationsCommandInput, BatchGetStandardsControlAssociationsCommandOutput> {
+    this.middlewareStack.use(getSerdePlugin(configuration, this.serialize, this.deserialize));
+    this.middlewareStack.use(
+      getEndpointPlugin(configuration, BatchGetStandardsControlAssociationsCommand.getEndpointParameterInstructions())
+    );
+
+    const stack = clientStack.concat(this.middlewareStack);
+
+    const { logger } = configuration;
+    const clientName = "SecurityHubClient";
+    const commandName = "BatchGetStandardsControlAssociationsCommand";
+    const handlerExecutionContext: HandlerExecutionContext = {
+      logger,
+      clientName,
+      commandName,
+      inputFilterSensitiveLog: BatchGetStandardsControlAssociationsRequestFilterSensitiveLog,
+      outputFilterSensitiveLog: BatchGetStandardsControlAssociationsResponseFilterSensitiveLog,
+    };
+    const { requestHandler } = configuration;
+    return stack.resolve(
+      (request: FinalizeHandlerArguments<any>) =>
+        requestHandler.handle(request.request as __HttpRequest, options || {}),
+      handlerExecutionContext
+    );
+  }
+
+  private serialize(
+    input: BatchGetStandardsControlAssociationsCommandInput,
+    context: __SerdeContext
+  ): Promise<__HttpRequest> {
+    return serializeAws_restJson1BatchGetStandardsControlAssociationsCommand(input, context);
+  }
+
+  private deserialize(
+    output: __HttpResponse,
+    context: __SerdeContext
+  ): Promise<BatchGetStandardsControlAssociationsCommandOutput> {
+    return deserializeAws_restJson1BatchGetStandardsControlAssociationsCommand(output, context);
+  }
+
+  // Start section: command_body_extra
+  // End section: command_body_extra
+}
diff --git a/clients/client-securityhub/src/commands/BatchUpdateStandardsControlAssociationsCommand.ts b/clients/client-securityhub/src/commands/BatchUpdateStandardsControlAssociationsCommand.ts
new file mode 100644
index 000000000000..ee235962e506
--- /dev/null
+++ b/clients/client-securityhub/src/commands/BatchUpdateStandardsControlAssociationsCommand.ts
@@ -0,0 +1,131 @@
+// smithy-typescript generated code
+import { EndpointParameterInstructions, getEndpointPlugin } from "@aws-sdk/middleware-endpoint";
+import { getSerdePlugin } from "@aws-sdk/middleware-serde";
+import { HttpRequest as __HttpRequest, HttpResponse as __HttpResponse } from "@aws-sdk/protocol-http";
+import { Command as $Command } from "@aws-sdk/smithy-client";
+import {
+  FinalizeHandlerArguments,
+  Handler,
+  HandlerExecutionContext,
+  HttpHandlerOptions as __HttpHandlerOptions,
+  MetadataBearer as __MetadataBearer,
+  MiddlewareStack,
+  SerdeContext as __SerdeContext,
+} from "@aws-sdk/types";
+
+import {
+  BatchUpdateStandardsControlAssociationsRequest,
+  BatchUpdateStandardsControlAssociationsRequestFilterSensitiveLog,
+  BatchUpdateStandardsControlAssociationsResponse,
+  BatchUpdateStandardsControlAssociationsResponseFilterSensitiveLog,
+} from "../models/models_1";
+import {
+  deserializeAws_restJson1BatchUpdateStandardsControlAssociationsCommand,
+  serializeAws_restJson1BatchUpdateStandardsControlAssociationsCommand,
+} from "../protocols/Aws_restJson1";
+import { SecurityHubClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes } from "../SecurityHubClient";
+
+export interface BatchUpdateStandardsControlAssociationsCommandInput
+  extends BatchUpdateStandardsControlAssociationsRequest {}
+export interface BatchUpdateStandardsControlAssociationsCommandOutput
+  extends BatchUpdateStandardsControlAssociationsResponse,
+    __MetadataBearer {}
+
+/**
+ * <p>
+ *          For a batch of security controls and standards, this operation updates the enablement status of a control in a standard.
+ *       </p>
+ * @example
+ * Use a bare-bones client and the command you need to make an API call.
+ * ```javascript
+ * import { SecurityHubClient, BatchUpdateStandardsControlAssociationsCommand } from "@aws-sdk/client-securityhub"; // ES Modules import
+ * // const { SecurityHubClient, BatchUpdateStandardsControlAssociationsCommand } = require("@aws-sdk/client-securityhub"); // CommonJS import
+ * const client = new SecurityHubClient(config);
+ * const command = new BatchUpdateStandardsControlAssociationsCommand(input);
+ * const response = await client.send(command);
+ * ```
+ *
+ * @see {@link BatchUpdateStandardsControlAssociationsCommandInput} for command's `input` shape.
+ * @see {@link BatchUpdateStandardsControlAssociationsCommandOutput} for command's `response` shape.
+ * @see {@link SecurityHubClientResolvedConfig | config} for SecurityHubClient's `config` shape.
+ *
+ */
+export class BatchUpdateStandardsControlAssociationsCommand extends $Command<
+  BatchUpdateStandardsControlAssociationsCommandInput,
+  BatchUpdateStandardsControlAssociationsCommandOutput,
+  SecurityHubClientResolvedConfig
+> {
+  // Start section: command_properties
+  // End section: command_properties
+
+  public static getEndpointParameterInstructions(): EndpointParameterInstructions {
+    return {
+      UseFIPS: { type: "builtInParams", name: "useFipsEndpoint" },
+      Endpoint: { type: "builtInParams", name: "endpoint" },
+      Region: { type: "builtInParams", name: "region" },
+      UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" },
+    };
+  }
+
+  constructor(readonly input: BatchUpdateStandardsControlAssociationsCommandInput) {
+    // Start section: command_constructor
+    super();
+    // End section: command_constructor
+  }
+
+  /**
+   * @internal
+   */
+  resolveMiddleware(
+    clientStack: MiddlewareStack<ServiceInputTypes, ServiceOutputTypes>,
+    configuration: SecurityHubClientResolvedConfig,
+    options?: __HttpHandlerOptions
+  ): Handler<
+    BatchUpdateStandardsControlAssociationsCommandInput,
+    BatchUpdateStandardsControlAssociationsCommandOutput
+  > {
+    this.middlewareStack.use(getSerdePlugin(configuration, this.serialize, this.deserialize));
+    this.middlewareStack.use(
+      getEndpointPlugin(
+        configuration,
+        BatchUpdateStandardsControlAssociationsCommand.getEndpointParameterInstructions()
+      )
+    );
+
+    const stack = clientStack.concat(this.middlewareStack);
+
+    const { logger } = configuration;
+    const clientName = "SecurityHubClient";
+    const commandName = "BatchUpdateStandardsControlAssociationsCommand";
+    const handlerExecutionContext: HandlerExecutionContext = {
+      logger,
+      clientName,
+      commandName,
+      inputFilterSensitiveLog: BatchUpdateStandardsControlAssociationsRequestFilterSensitiveLog,
+      outputFilterSensitiveLog: BatchUpdateStandardsControlAssociationsResponseFilterSensitiveLog,
+    };
+    const { requestHandler } = configuration;
+    return stack.resolve(
+      (request: FinalizeHandlerArguments<any>) =>
+        requestHandler.handle(request.request as __HttpRequest, options || {}),
+      handlerExecutionContext
+    );
+  }
+
+  private serialize(
+    input: BatchUpdateStandardsControlAssociationsCommandInput,
+    context: __SerdeContext
+  ): Promise<__HttpRequest> {
+    return serializeAws_restJson1BatchUpdateStandardsControlAssociationsCommand(input, context);
+  }
+
+  private deserialize(
+    output: __HttpResponse,
+    context: __SerdeContext
+  ): Promise<BatchUpdateStandardsControlAssociationsCommandOutput> {
+    return deserializeAws_restJson1BatchUpdateStandardsControlAssociationsCommand(output, context);
+  }
+
+  // Start section: command_body_extra
+  // End section: command_body_extra
+}
diff --git a/clients/client-securityhub/src/commands/DeleteFindingAggregatorCommand.ts b/clients/client-securityhub/src/commands/DeleteFindingAggregatorCommand.ts
index 3809a9b89ab5..d8bc09ffecc6 100644
--- a/clients/client-securityhub/src/commands/DeleteFindingAggregatorCommand.ts
+++ b/clients/client-securityhub/src/commands/DeleteFindingAggregatorCommand.ts
@@ -18,7 +18,7 @@ import {
   DeleteFindingAggregatorRequestFilterSensitiveLog,
   DeleteFindingAggregatorResponse,
   DeleteFindingAggregatorResponseFilterSensitiveLog,
-} from "../models/models_1";
+} from "../models/models_2";
 import {
   deserializeAws_restJson1DeleteFindingAggregatorCommand,
   serializeAws_restJson1DeleteFindingAggregatorCommand,
diff --git a/clients/client-securityhub/src/commands/DeleteInsightCommand.ts b/clients/client-securityhub/src/commands/DeleteInsightCommand.ts
index b46db9789463..95539bfab497 100644
--- a/clients/client-securityhub/src/commands/DeleteInsightCommand.ts
+++ b/clients/client-securityhub/src/commands/DeleteInsightCommand.ts
@@ -18,7 +18,7 @@ import {
   DeleteInsightRequestFilterSensitiveLog,
   DeleteInsightResponse,
   DeleteInsightResponseFilterSensitiveLog,
-} from "../models/models_1";
+} from "../models/models_2";
 import {
   deserializeAws_restJson1DeleteInsightCommand,
   serializeAws_restJson1DeleteInsightCommand,
diff --git a/clients/client-securityhub/src/commands/DeleteInvitationsCommand.ts b/clients/client-securityhub/src/commands/DeleteInvitationsCommand.ts
index b3d0f8ea470d..b19e4b66e657 100644
--- a/clients/client-securityhub/src/commands/DeleteInvitationsCommand.ts
+++ b/clients/client-securityhub/src/commands/DeleteInvitationsCommand.ts
@@ -18,7 +18,7 @@ import {
   DeleteInvitationsRequestFilterSensitiveLog,
   DeleteInvitationsResponse,
   DeleteInvitationsResponseFilterSensitiveLog,
-} from "../models/models_1";
+} from "../models/models_2";
 import {
   deserializeAws_restJson1DeleteInvitationsCommand,
   serializeAws_restJson1DeleteInvitationsCommand,
diff --git a/clients/client-securityhub/src/commands/DeleteMembersCommand.ts b/clients/client-securityhub/src/commands/DeleteMembersCommand.ts
index d410b42d825c..23a834d594ce 100644
--- a/clients/client-securityhub/src/commands/DeleteMembersCommand.ts
+++ b/clients/client-securityhub/src/commands/DeleteMembersCommand.ts
@@ -18,7 +18,7 @@ import {
   DeleteMembersRequestFilterSensitiveLog,
   DeleteMembersResponse,
   DeleteMembersResponseFilterSensitiveLog,
-} from "../models/models_1";
+} from "../models/models_2";
 import {
   deserializeAws_restJson1DeleteMembersCommand,
   serializeAws_restJson1DeleteMembersCommand,
diff --git a/clients/client-securityhub/src/commands/DescribeActionTargetsCommand.ts b/clients/client-securityhub/src/commands/DescribeActionTargetsCommand.ts
index 18b5655ad1f4..561835026fd4 100644
--- a/clients/client-securityhub/src/commands/DescribeActionTargetsCommand.ts
+++ b/clients/client-securityhub/src/commands/DescribeActionTargetsCommand.ts
@@ -18,7 +18,7 @@ import {
   DescribeActionTargetsRequestFilterSensitiveLog,
   DescribeActionTargetsResponse,
   DescribeActionTargetsResponseFilterSensitiveLog,
-} from "../models/models_1";
+} from "../models/models_2";
 import {
   deserializeAws_restJson1DescribeActionTargetsCommand,
   serializeAws_restJson1DescribeActionTargetsCommand,
diff --git a/clients/client-securityhub/src/commands/DescribeHubCommand.ts b/clients/client-securityhub/src/commands/DescribeHubCommand.ts
index 990b0ee8cf1f..34eda68e7a57 100644
--- a/clients/client-securityhub/src/commands/DescribeHubCommand.ts
+++ b/clients/client-securityhub/src/commands/DescribeHubCommand.ts
@@ -18,7 +18,7 @@ import {
   DescribeHubRequestFilterSensitiveLog,
   DescribeHubResponse,
   DescribeHubResponseFilterSensitiveLog,
-} from "../models/models_1";
+} from "../models/models_2";
 import {
   deserializeAws_restJson1DescribeHubCommand,
   serializeAws_restJson1DescribeHubCommand,
diff --git a/clients/client-securityhub/src/commands/DescribeOrganizationConfigurationCommand.ts b/clients/client-securityhub/src/commands/DescribeOrganizationConfigurationCommand.ts
index 6fab4604aabd..edb6a08f1988 100644
--- a/clients/client-securityhub/src/commands/DescribeOrganizationConfigurationCommand.ts
+++ b/clients/client-securityhub/src/commands/DescribeOrganizationConfigurationCommand.ts
@@ -18,7 +18,7 @@ import {
   DescribeOrganizationConfigurationRequestFilterSensitiveLog,
   DescribeOrganizationConfigurationResponse,
   DescribeOrganizationConfigurationResponseFilterSensitiveLog,
-} from "../models/models_1";
+} from "../models/models_2";
 import {
   deserializeAws_restJson1DescribeOrganizationConfigurationCommand,
   serializeAws_restJson1DescribeOrganizationConfigurationCommand,
diff --git a/clients/client-securityhub/src/commands/DescribeProductsCommand.ts b/clients/client-securityhub/src/commands/DescribeProductsCommand.ts
index 49b8f34f4c14..ae9f8e92ebd9 100644
--- a/clients/client-securityhub/src/commands/DescribeProductsCommand.ts
+++ b/clients/client-securityhub/src/commands/DescribeProductsCommand.ts
@@ -13,8 +13,12 @@ import {
   SerdeContext as __SerdeContext,
 } from "@aws-sdk/types";
 
-import { DescribeProductsRequest, DescribeProductsRequestFilterSensitiveLog } from "../models/models_1";
-import { DescribeProductsResponse, DescribeProductsResponseFilterSensitiveLog } from "../models/models_2";
+import {
+  DescribeProductsRequest,
+  DescribeProductsRequestFilterSensitiveLog,
+  DescribeProductsResponse,
+  DescribeProductsResponseFilterSensitiveLog,
+} from "../models/models_2";
 import {
   deserializeAws_restJson1DescribeProductsCommand,
   serializeAws_restJson1DescribeProductsCommand,
diff --git a/clients/client-securityhub/src/commands/ListSecurityControlDefinitionsCommand.ts b/clients/client-securityhub/src/commands/ListSecurityControlDefinitionsCommand.ts
new file mode 100644
index 000000000000..da7f264ffc06
--- /dev/null
+++ b/clients/client-securityhub/src/commands/ListSecurityControlDefinitionsCommand.ts
@@ -0,0 +1,124 @@
+// smithy-typescript generated code
+import { EndpointParameterInstructions, getEndpointPlugin } from "@aws-sdk/middleware-endpoint";
+import { getSerdePlugin } from "@aws-sdk/middleware-serde";
+import { HttpRequest as __HttpRequest, HttpResponse as __HttpResponse } from "@aws-sdk/protocol-http";
+import { Command as $Command } from "@aws-sdk/smithy-client";
+import {
+  FinalizeHandlerArguments,
+  Handler,
+  HandlerExecutionContext,
+  HttpHandlerOptions as __HttpHandlerOptions,
+  MetadataBearer as __MetadataBearer,
+  MiddlewareStack,
+  SerdeContext as __SerdeContext,
+} from "@aws-sdk/types";
+
+import {
+  ListSecurityControlDefinitionsRequest,
+  ListSecurityControlDefinitionsRequestFilterSensitiveLog,
+  ListSecurityControlDefinitionsResponse,
+  ListSecurityControlDefinitionsResponseFilterSensitiveLog,
+} from "../models/models_2";
+import {
+  deserializeAws_restJson1ListSecurityControlDefinitionsCommand,
+  serializeAws_restJson1ListSecurityControlDefinitionsCommand,
+} from "../protocols/Aws_restJson1";
+import { SecurityHubClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes } from "../SecurityHubClient";
+
+export interface ListSecurityControlDefinitionsCommandInput extends ListSecurityControlDefinitionsRequest {}
+export interface ListSecurityControlDefinitionsCommandOutput
+  extends ListSecurityControlDefinitionsResponse,
+    __MetadataBearer {}
+
+/**
+ * <p>
+ *          Lists all of the security controls that apply to a specified standard.
+ *       </p>
+ * @example
+ * Use a bare-bones client and the command you need to make an API call.
+ * ```javascript
+ * import { SecurityHubClient, ListSecurityControlDefinitionsCommand } from "@aws-sdk/client-securityhub"; // ES Modules import
+ * // const { SecurityHubClient, ListSecurityControlDefinitionsCommand } = require("@aws-sdk/client-securityhub"); // CommonJS import
+ * const client = new SecurityHubClient(config);
+ * const command = new ListSecurityControlDefinitionsCommand(input);
+ * const response = await client.send(command);
+ * ```
+ *
+ * @see {@link ListSecurityControlDefinitionsCommandInput} for command's `input` shape.
+ * @see {@link ListSecurityControlDefinitionsCommandOutput} for command's `response` shape.
+ * @see {@link SecurityHubClientResolvedConfig | config} for SecurityHubClient's `config` shape.
+ *
+ */
+export class ListSecurityControlDefinitionsCommand extends $Command<
+  ListSecurityControlDefinitionsCommandInput,
+  ListSecurityControlDefinitionsCommandOutput,
+  SecurityHubClientResolvedConfig
+> {
+  // Start section: command_properties
+  // End section: command_properties
+
+  public static getEndpointParameterInstructions(): EndpointParameterInstructions {
+    return {
+      UseFIPS: { type: "builtInParams", name: "useFipsEndpoint" },
+      Endpoint: { type: "builtInParams", name: "endpoint" },
+      Region: { type: "builtInParams", name: "region" },
+      UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" },
+    };
+  }
+
+  constructor(readonly input: ListSecurityControlDefinitionsCommandInput) {
+    // Start section: command_constructor
+    super();
+    // End section: command_constructor
+  }
+
+  /**
+   * @internal
+   */
+  resolveMiddleware(
+    clientStack: MiddlewareStack<ServiceInputTypes, ServiceOutputTypes>,
+    configuration: SecurityHubClientResolvedConfig,
+    options?: __HttpHandlerOptions
+  ): Handler<ListSecurityControlDefinitionsCommandInput, ListSecurityControlDefinitionsCommandOutput> {
+    this.middlewareStack.use(getSerdePlugin(configuration, this.serialize, this.deserialize));
+    this.middlewareStack.use(
+      getEndpointPlugin(configuration, ListSecurityControlDefinitionsCommand.getEndpointParameterInstructions())
+    );
+
+    const stack = clientStack.concat(this.middlewareStack);
+
+    const { logger } = configuration;
+    const clientName = "SecurityHubClient";
+    const commandName = "ListSecurityControlDefinitionsCommand";
+    const handlerExecutionContext: HandlerExecutionContext = {
+      logger,
+      clientName,
+      commandName,
+      inputFilterSensitiveLog: ListSecurityControlDefinitionsRequestFilterSensitiveLog,
+      outputFilterSensitiveLog: ListSecurityControlDefinitionsResponseFilterSensitiveLog,
+    };
+    const { requestHandler } = configuration;
+    return stack.resolve(
+      (request: FinalizeHandlerArguments<any>) =>
+        requestHandler.handle(request.request as __HttpRequest, options || {}),
+      handlerExecutionContext
+    );
+  }
+
+  private serialize(
+    input: ListSecurityControlDefinitionsCommandInput,
+    context: __SerdeContext
+  ): Promise<__HttpRequest> {
+    return serializeAws_restJson1ListSecurityControlDefinitionsCommand(input, context);
+  }
+
+  private deserialize(
+    output: __HttpResponse,
+    context: __SerdeContext
+  ): Promise<ListSecurityControlDefinitionsCommandOutput> {
+    return deserializeAws_restJson1ListSecurityControlDefinitionsCommand(output, context);
+  }
+
+  // Start section: command_body_extra
+  // End section: command_body_extra
+}
diff --git a/clients/client-securityhub/src/commands/ListStandardsControlAssociationsCommand.ts b/clients/client-securityhub/src/commands/ListStandardsControlAssociationsCommand.ts
new file mode 100644
index 000000000000..12ad465d9c01
--- /dev/null
+++ b/clients/client-securityhub/src/commands/ListStandardsControlAssociationsCommand.ts
@@ -0,0 +1,124 @@
+// smithy-typescript generated code
+import { EndpointParameterInstructions, getEndpointPlugin } from "@aws-sdk/middleware-endpoint";
+import { getSerdePlugin } from "@aws-sdk/middleware-serde";
+import { HttpRequest as __HttpRequest, HttpResponse as __HttpResponse } from "@aws-sdk/protocol-http";
+import { Command as $Command } from "@aws-sdk/smithy-client";
+import {
+  FinalizeHandlerArguments,
+  Handler,
+  HandlerExecutionContext,
+  HttpHandlerOptions as __HttpHandlerOptions,
+  MetadataBearer as __MetadataBearer,
+  MiddlewareStack,
+  SerdeContext as __SerdeContext,
+} from "@aws-sdk/types";
+
+import {
+  ListStandardsControlAssociationsRequest,
+  ListStandardsControlAssociationsRequestFilterSensitiveLog,
+  ListStandardsControlAssociationsResponse,
+  ListStandardsControlAssociationsResponseFilterSensitiveLog,
+} from "../models/models_2";
+import {
+  deserializeAws_restJson1ListStandardsControlAssociationsCommand,
+  serializeAws_restJson1ListStandardsControlAssociationsCommand,
+} from "../protocols/Aws_restJson1";
+import { SecurityHubClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes } from "../SecurityHubClient";
+
+export interface ListStandardsControlAssociationsCommandInput extends ListStandardsControlAssociationsRequest {}
+export interface ListStandardsControlAssociationsCommandOutput
+  extends ListStandardsControlAssociationsResponse,
+    __MetadataBearer {}
+
+/**
+ * <p>
+ *          Specifies whether a control is currently enabled or disabled in each enabled standard in the calling account.
+ *       </p>
+ * @example
+ * Use a bare-bones client and the command you need to make an API call.
+ * ```javascript
+ * import { SecurityHubClient, ListStandardsControlAssociationsCommand } from "@aws-sdk/client-securityhub"; // ES Modules import
+ * // const { SecurityHubClient, ListStandardsControlAssociationsCommand } = require("@aws-sdk/client-securityhub"); // CommonJS import
+ * const client = new SecurityHubClient(config);
+ * const command = new ListStandardsControlAssociationsCommand(input);
+ * const response = await client.send(command);
+ * ```
+ *
+ * @see {@link ListStandardsControlAssociationsCommandInput} for command's `input` shape.
+ * @see {@link ListStandardsControlAssociationsCommandOutput} for command's `response` shape.
+ * @see {@link SecurityHubClientResolvedConfig | config} for SecurityHubClient's `config` shape.
+ *
+ */
+export class ListStandardsControlAssociationsCommand extends $Command<
+  ListStandardsControlAssociationsCommandInput,
+  ListStandardsControlAssociationsCommandOutput,
+  SecurityHubClientResolvedConfig
+> {
+  // Start section: command_properties
+  // End section: command_properties
+
+  public static getEndpointParameterInstructions(): EndpointParameterInstructions {
+    return {
+      UseFIPS: { type: "builtInParams", name: "useFipsEndpoint" },
+      Endpoint: { type: "builtInParams", name: "endpoint" },
+      Region: { type: "builtInParams", name: "region" },
+      UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" },
+    };
+  }
+
+  constructor(readonly input: ListStandardsControlAssociationsCommandInput) {
+    // Start section: command_constructor
+    super();
+    // End section: command_constructor
+  }
+
+  /**
+   * @internal
+   */
+  resolveMiddleware(
+    clientStack: MiddlewareStack<ServiceInputTypes, ServiceOutputTypes>,
+    configuration: SecurityHubClientResolvedConfig,
+    options?: __HttpHandlerOptions
+  ): Handler<ListStandardsControlAssociationsCommandInput, ListStandardsControlAssociationsCommandOutput> {
+    this.middlewareStack.use(getSerdePlugin(configuration, this.serialize, this.deserialize));
+    this.middlewareStack.use(
+      getEndpointPlugin(configuration, ListStandardsControlAssociationsCommand.getEndpointParameterInstructions())
+    );
+
+    const stack = clientStack.concat(this.middlewareStack);
+
+    const { logger } = configuration;
+    const clientName = "SecurityHubClient";
+    const commandName = "ListStandardsControlAssociationsCommand";
+    const handlerExecutionContext: HandlerExecutionContext = {
+      logger,
+      clientName,
+      commandName,
+      inputFilterSensitiveLog: ListStandardsControlAssociationsRequestFilterSensitiveLog,
+      outputFilterSensitiveLog: ListStandardsControlAssociationsResponseFilterSensitiveLog,
+    };
+    const { requestHandler } = configuration;
+    return stack.resolve(
+      (request: FinalizeHandlerArguments<any>) =>
+        requestHandler.handle(request.request as __HttpRequest, options || {}),
+      handlerExecutionContext
+    );
+  }
+
+  private serialize(
+    input: ListStandardsControlAssociationsCommandInput,
+    context: __SerdeContext
+  ): Promise<__HttpRequest> {
+    return serializeAws_restJson1ListStandardsControlAssociationsCommand(input, context);
+  }
+
+  private deserialize(
+    output: __HttpResponse,
+    context: __SerdeContext
+  ): Promise<ListStandardsControlAssociationsCommandOutput> {
+    return deserializeAws_restJson1ListStandardsControlAssociationsCommand(output, context);
+  }
+
+  // Start section: command_body_extra
+  // End section: command_body_extra
+}
diff --git a/clients/client-securityhub/src/commands/index.ts b/clients/client-securityhub/src/commands/index.ts
index f124ad9ca3fc..101c7e374333 100644
--- a/clients/client-securityhub/src/commands/index.ts
+++ b/clients/client-securityhub/src/commands/index.ts
@@ -3,8 +3,11 @@ export * from "./AcceptAdministratorInvitationCommand";
 export * from "./AcceptInvitationCommand";
 export * from "./BatchDisableStandardsCommand";
 export * from "./BatchEnableStandardsCommand";
+export * from "./BatchGetSecurityControlsCommand";
+export * from "./BatchGetStandardsControlAssociationsCommand";
 export * from "./BatchImportFindingsCommand";
 export * from "./BatchUpdateFindingsCommand";
+export * from "./BatchUpdateStandardsControlAssociationsCommand";
 export * from "./CreateActionTargetCommand";
 export * from "./CreateFindingAggregatorCommand";
 export * from "./CreateInsightCommand";
@@ -45,6 +48,8 @@ export * from "./ListFindingAggregatorsCommand";
 export * from "./ListInvitationsCommand";
 export * from "./ListMembersCommand";
 export * from "./ListOrganizationAdminAccountsCommand";
+export * from "./ListSecurityControlDefinitionsCommand";
+export * from "./ListStandardsControlAssociationsCommand";
 export * from "./ListTagsForResourceCommand";
 export * from "./TagResourceCommand";
 export * from "./UntagResourceCommand";
diff --git a/clients/client-securityhub/src/models/models_0.ts b/clients/client-securityhub/src/models/models_0.ts
index be77ee6873c5..4a287682dfff 100644
--- a/clients/client-securityhub/src/models/models_0.ts
+++ b/clients/client-securityhub/src/models/models_0.ts
@@ -629,6 +629,11 @@ export interface AssociatedStandard {
   StandardsId?: string;
 }
 
+export enum AssociationStatus {
+  DISABLED = "DISABLED",
+  ENABLED = "ENABLED",
+}
+
 export enum AutoEnableStandards {
   DEFAULT = "DEFAULT",
   NONE = "NONE",
@@ -1856,8 +1861,8 @@ export interface AwsBackupBackupVaultNotificationsDetails {
   BackupVaultEvents?: string[];
 
   /**
-   * <p>An ARN that uniquely identifies the Amazon SNS topic for a backup vault’s events.
-   *       </p>
+   * <p>The Amazon Resource Name (ARN) that uniquely identifies the Amazon SNS topic for
+   *          a backup vault's events. </p>
    */
   SnsTopicArn?: string;
 }
@@ -4914,8 +4919,11 @@ export interface AwsEc2LaunchTemplateDataInstanceRequirementsDetails {
   NetworkInterfaceCount?: AwsEc2LaunchTemplateDataInstanceRequirementsNetworkInterfaceCountDetails;
 
   /**
-   * <p>
-   *          The price protection threshold for On-Demand Instances. This is the maximum you’ll pay for an On-Demand Instance, expressed as a percentage above the least expensive current generation M, C, or R instance type with your specified attributes. When Amazon EC2 selects instance types with your attributes, it excludes instance types priced above your threshold.</p>
+   * <p> The price protection threshold for On-Demand Instances. This is the maximum you'll pay
+   *          for an On-Demand Instance, expressed as a percentage above the least expensive current
+   *          generation M, C, or R instance type with your specified attributes. When Amazon EC2 selects
+   *          instance types with your attributes, it excludes instance types priced above your
+   *          threshold.</p>
    *          <p>The parameter accepts an integer, which Amazon EC2 interprets as a percentage.</p>
    *          <p>A high value, such as <code>999999</code>, turns off price protection.</p>
    */
@@ -4929,11 +4937,10 @@ export interface AwsEc2LaunchTemplateDataInstanceRequirementsDetails {
   RequireHibernateSupport?: boolean;
 
   /**
-   * <p>
-   *          The price protection threshold for Spot Instances. This is the maximum you’ll pay for a Spot Instance, expressed as a
-   *          percentage above the least expensive current generation M, C, or R instance type with your specified attributes. When
-   *          Amazon EC2 selects instance types with your attributes, it excludes instance types priced above your threshold.
-   *       </p>
+   * <p> The price protection threshold for Spot Instances. This is the maximum you'll pay for a
+   *          Spot Instance, expressed as a percentage above the least expensive current generation M, C,
+   *          or R instance type with your specified attributes. When Amazon EC2 selects instance
+   *          types with your attributes, it excludes instance types priced above your threshold. </p>
    *          <p>The parameter accepts an integer, which Amazon EC2 interprets as a percentage.</p>
    *          <p>A high value, such as <code>999999</code>, turns off price protection.</p>
    */
@@ -4989,9 +4996,9 @@ export interface AwsEc2LaunchTemplateDataMaintenanceOptionsDetails {
  */
 export interface AwsEc2LaunchTemplateDataMetadataOptionsDetails {
   /**
-   * <p>
-   *          Enables or disables the HTTP metadata endpoint on your instances. If the parameter is not specified, the default state is enabled, and you won’t be able to access your instance metadata.
-   *       </p>
+   * <p> Enables or disables the HTTP metadata endpoint on your instances. If the parameter is
+   *          not specified, the default state is enabled, and you won't be able to access your instance
+   *          metadata. </p>
    */
   HttpEndpoint?: string;
 
@@ -10291,16 +10298,6 @@ export interface AwsIamAttachedManagedPolicy {
   PolicyArn?: string;
 }
 
-/**
- * <p>A managed policy that is attached to the IAM group.</p>
- */
-export interface AwsIamGroupPolicy {
-  /**
-   * <p>The name of the policy.</p>
-   */
-  PolicyName?: string;
-}
-
 /**
  * @internal
  */
@@ -12664,10 +12661,3 @@ export const AwsIamAccessKeyDetailsFilterSensitiveLog = (obj: AwsIamAccessKeyDet
 export const AwsIamAttachedManagedPolicyFilterSensitiveLog = (obj: AwsIamAttachedManagedPolicy): any => ({
   ...obj,
 });
-
-/**
- * @internal
- */
-export const AwsIamGroupPolicyFilterSensitiveLog = (obj: AwsIamGroupPolicy): any => ({
-  ...obj,
-});
diff --git a/clients/client-securityhub/src/models/models_1.ts b/clients/client-securityhub/src/models/models_1.ts
index 6541c3f8a03d..1c8976e82350 100644
--- a/clients/client-securityhub/src/models/models_1.ts
+++ b/clients/client-securityhub/src/models/models_1.ts
@@ -4,10 +4,9 @@ import { ExceptionOptionType as __ExceptionOptionType } from "@aws-sdk/smithy-cl
 import {
   AccountDetails,
   Action,
-  ActionTarget,
   Adjustment,
   AssociatedStandard,
-  AutoEnableStandards,
+  AssociationStatus,
   AwsApiGatewayRestApiDetails,
   AwsApiGatewayStageDetails,
   AwsApiGatewayV2ApiDetails,
@@ -52,10 +51,19 @@ import {
   AwsElbv2LoadBalancerDetails,
   AwsIamAccessKeyDetails,
   AwsIamAttachedManagedPolicy,
-  AwsIamGroupPolicy,
 } from "./models_0";
 import { SecurityHubServiceException as __BaseException } from "./SecurityHubServiceException";
 
+/**
+ * <p>A managed policy that is attached to the IAM group.</p>
+ */
+export interface AwsIamGroupPolicy {
+  /**
+   * <p>The name of the policy.</p>
+   */
+  PolicyName?: string;
+}
+
 /**
  * <p>Contains details about an IAM group.</p>
  */
@@ -3314,7 +3322,8 @@ export interface AwsRedshiftClusterClusterSecurityGroup {
 }
 
 /**
- * <p>Information about a cross-Region snapshot copy.</p>
+ * <p>You can configure Amazon Redshift to copy snapshots for a cluster to another Amazon Web Services Region. This parameter
+ *          provides information about a cross-Region snapshot copy.</p>
  */
 export interface AwsRedshiftClusterClusterSnapshotCopyStatus {
   /**
@@ -3324,8 +3333,8 @@ export interface AwsRedshiftClusterClusterSnapshotCopyStatus {
   DestinationRegion?: string;
 
   /**
-   * <p>The number of days that manual snapshots are retained in the destination region after
-   *          they are copied from a source region.</p>
+   * <p>The number of days that manual snapshots are retained in the destination Region after
+   *          they are copied from a source Region.</p>
    *          <p>If the value is <code>-1</code>,
    *          then the manual snapshot is retained indefinitely.</p>
    *          <p>Valid values: Either <code>-1</code>
@@ -7596,7 +7605,7 @@ export interface Resource {
 /**
  * <p>The severity of the finding.</p>
  *          <p>The finding provider can provide the initial severity. The finding provider can only
- *          update the severity if it has not been updated using
+ *          update the severity if it hasn't been updated using
  *          <code>BatchUpdateFindings</code>.</p>
  *          <p>The finding must have either <code>Label</code> or <code>Normalized</code> populated. If
  *          only one of these attributes is populated, then Security Hub automatically populates the other
@@ -9353,6 +9362,291 @@ export interface BatchEnableStandardsResponse {
   StandardsSubscriptions?: StandardsSubscription[];
 }
 
+export interface BatchGetSecurityControlsRequest {
+  /**
+   * <p> A list of security controls (identified with <code>SecurityControlId</code>,
+   *             <code>SecurityControlArn</code>, or a mix of both parameters). The security control ID
+   *          or Amazon Resource Name (ARN) is the same across standards. </p>
+   */
+  SecurityControlIds: string[] | undefined;
+}
+
+export enum ControlStatus {
+  DISABLED = "DISABLED",
+  ENABLED = "ENABLED",
+}
+
+export enum SeverityRating {
+  CRITICAL = "CRITICAL",
+  HIGH = "HIGH",
+  LOW = "LOW",
+  MEDIUM = "MEDIUM",
+}
+
+/**
+ * <p>
+ *          A security control in Security Hub describes a security best practice related to a specific resource.
+ *       </p>
+ */
+export interface SecurityControl {
+  /**
+   * <p>
+   *          The unique identifier of a security control across standards. Values for this field typically consist of an Amazon Web Service name and a
+   *          number, such as APIGateway.3.
+   *       </p>
+   */
+  SecurityControlId: string | undefined;
+
+  /**
+   * <p> The Amazon Resource Name (ARN) for a security control across standards, such as
+   *             <code>arn:aws:securityhub:eu-central-1:123456789012:security-control/S3.1</code>. This
+   *          parameter doesn't mention a specific standard. </p>
+   */
+  SecurityControlArn: string | undefined;
+
+  /**
+   * <p>The title of a security control.
+   *       </p>
+   */
+  Title: string | undefined;
+
+  /**
+   * <p> The description of a security control across standards. This typically summarizes how
+   *             Security Hub evaluates the control and the conditions under which it produces a
+   *          failed finding. This parameter doesn't reference a specific standard. </p>
+   */
+  Description: string | undefined;
+
+  /**
+   * <p>
+   *          A link to Security Hub documentation that explains how to remediate a failed finding for a security control.
+   *       </p>
+   */
+  RemediationUrl: string | undefined;
+
+  /**
+   * <p>
+   *          The severity of a security control. For more information about how Security Hub determines control severity, see
+   *          <a href="https://docs.aws.amazon.com/securityhub/latest/userguide/controls-findings-create-update.html#control-findings-severity">Assigning severity to control findings</a> in the
+   *          <i>Security Hub User Guide</i>.
+   *       </p>
+   */
+  SeverityRating: SeverityRating | string | undefined;
+
+  /**
+   * <p>
+   *          The status of a security control based on the compliance status of its findings. For more information about how control
+   *          status is determined, see <a href="https://docs.aws.amazon.com/securityhub/latest/userguide/controls-overall-status.html">Determining the overall status of a control from its findings</a> in the
+   *          <i>Security Hub User Guide</i>.
+   *       </p>
+   */
+  SecurityControlStatus: ControlStatus | string | undefined;
+}
+
+export enum UnprocessedErrorCode {
+  ACCESS_DENIED = "ACCESS_DENIED",
+  INVALID_INPUT = "INVALID_INPUT",
+  LIMIT_EXCEEDED = "LIMIT_EXCEEDED",
+  NOT_FOUND = "NOT_FOUND",
+}
+
+/**
+ * <p> Provides details about a security control for which a response couldn't be returned. </p>
+ */
+export interface UnprocessedSecurityControl {
+  /**
+   * <p> The control (identified with <code>SecurityControlId</code>,
+   *             <code>SecurityControlArn</code>, or a mix of both parameters) for which a response
+   *          couldn't be returned. </p>
+   */
+  SecurityControlId: string | undefined;
+
+  /**
+   * <p>
+   *          The error code for the unprocessed security control.
+   *       </p>
+   */
+  ErrorCode: UnprocessedErrorCode | string | undefined;
+
+  /**
+   * <p>
+   *          The reason why the security control was unprocessed.
+   *       </p>
+   */
+  ErrorReason?: string;
+}
+
+export interface BatchGetSecurityControlsResponse {
+  /**
+   * <p>
+   *          An array that returns the identifier, Amazon Resource Name (ARN), and other details about a security control.
+   *          The same information is returned whether the request includes <code>SecurityControlId</code> or <code>SecurityControlArn</code>.
+   *       </p>
+   */
+  SecurityControls: SecurityControl[] | undefined;
+
+  /**
+   * <p>
+   *          A security control (identified with <code>SecurityControlId</code>, <code>SecurityControlArn</code>, or a mix of both parameters) for which
+   *          details cannot be returned.
+   *       </p>
+   */
+  UnprocessedIds?: UnprocessedSecurityControl[];
+}
+
+/**
+ * <p>
+ *          An array with one or more objects that includes a security control (identified with <code>SecurityControlId</code>, <code>SecurityControlArn</code>, or a mix of both parameters)
+ *          and the Amazon Resource Name (ARN) of a standard. The security control ID or ARN is the same across standards.
+ *       </p>
+ */
+export interface StandardsControlAssociationId {
+  /**
+   * <p>
+   *          The unique identifier (identified with <code>SecurityControlId</code>, <code>SecurityControlArn</code>, or a mix of both parameters) of a security
+   *          control across standards.
+   *       </p>
+   */
+  SecurityControlId: string | undefined;
+
+  /**
+   * <p>
+   *          The ARN of a standard.
+   *       </p>
+   */
+  StandardsArn: string | undefined;
+}
+
+export interface BatchGetStandardsControlAssociationsRequest {
+  /**
+   * <p>
+   *          An array with one or more objects that includes a security control (identified with <code>SecurityControlId</code>, <code>SecurityControlArn</code>, or a mix of both parameters) and the Amazon Resource Name (ARN) of a standard.
+   *          This field is used to query the enablement status of a control in a specified standard. The security control ID or ARN is the same across standards.
+   *       </p>
+   */
+  StandardsControlAssociationIds: StandardsControlAssociationId[] | undefined;
+}
+
+/**
+ * <p> Provides details about a control's enablement status in a specified standard. </p>
+ */
+export interface StandardsControlAssociationDetail {
+  /**
+   * <p>
+   *          The Amazon Resource Name (ARN) of a security standard.
+   *       </p>
+   */
+  StandardsArn: string | undefined;
+
+  /**
+   * <p>
+   *          The unique identifier of a security control across standards. Values for this field typically consist of an Amazon Web Service
+   *          name and a number, such as APIGateway.3.
+   *       </p>
+   */
+  SecurityControlId: string | undefined;
+
+  /**
+   * <p> The ARN of a security control across standards, such as
+   *             <code>arn:aws:securityhub:eu-central-1:123456789012:security-control/S3.1</code>. This
+   *          parameter doesn't mention a specific standard. </p>
+   */
+  SecurityControlArn: string | undefined;
+
+  /**
+   * <p>
+   *          Specifies whether a control is enabled or disabled in a specified standard.
+   *       </p>
+   */
+  AssociationStatus: AssociationStatus | string | undefined;
+
+  /**
+   * <p>
+   *          The requirement that underlies a control in the compliance framework related to the standard.
+   *       </p>
+   */
+  RelatedRequirements?: string[];
+
+  /**
+   * <p>
+   *          The time at which the enablement status of the control in the specified standard was last updated.
+   *       </p>
+   */
+  UpdatedAt?: Date;
+
+  /**
+   * <p>
+   *          The reason for updating the enablement status of a control in a specified standard.
+   *       </p>
+   */
+  UpdatedReason?: string;
+
+  /**
+   * <p>
+   *          The title of a control. This field may reference a specific standard.
+   *       </p>
+   */
+  StandardsControlTitle?: string;
+
+  /**
+   * <p>
+   *          The description of a control. This typically summarizes how Security Hub evaluates the control and the
+   *          conditions under which it produces a failed finding. This parameter may reference a specific standard.
+   *       </p>
+   */
+  StandardsControlDescription?: string;
+
+  /**
+   * <p> Provides the input parameter that Security Hub uses to call the <a href="https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UpdateStandardsControl.html">UpdateStandardsControl</a> API. This API can be used to enable or disable a control
+   *          in a specified standard. </p>
+   */
+  StandardsControlArns?: string[];
+}
+
+/**
+ * <p> Provides details about which
+ *          control's enablement status couldn't be retrieved in a specified standard when calling <a href="https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchUpdateStandardsControlAssociations.html">BatchUpdateStandardsControlAssociations</a>. This parameter also provides details
+ *          about why the request was unprocessed. </p>
+ */
+export interface UnprocessedStandardsControlAssociation {
+  /**
+   * <p> An array with one or more objects that includes a security control (identified with
+   *             <code>SecurityControlId</code>, <code>SecurityControlArn</code>, or a mix of both
+   *          parameters) and the Amazon Resource Name (ARN) of a standard. This parameter shows the
+   *          specific controls for which the enablement status couldn't be retrieved in specified standards when
+   *          calling <a href="https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchUpdateStandardsControlAssociations.html">BatchUpdateStandardsControlAssociations</a>. </p>
+   */
+  StandardsControlAssociationId: StandardsControlAssociationId | undefined;
+
+  /**
+   * <p>The error code for the unprocessed standard and control association.
+   *       </p>
+   */
+  ErrorCode: UnprocessedErrorCode | string | undefined;
+
+  /**
+   * <p>The reason why the standard and control association was unprocessed. </p>
+   */
+  ErrorReason?: string;
+}
+
+export interface BatchGetStandardsControlAssociationsResponse {
+  /**
+   * <p>Provides the enablement status of a security control in a specified standard and other details for the control in relation to
+   *          the specified standard.
+   *       </p>
+   */
+  StandardsControlAssociationDetails: StandardsControlAssociationDetail[] | undefined;
+
+  /**
+   * <p>
+   *          A security control (identified with <code>SecurityControlId</code>, <code>SecurityControlArn</code>, or a mix of both parameters) whose enablement
+   *          status in a specified standard cannot be returned.
+   *       </p>
+   */
+  UnprocessedAssociations?: UnprocessedStandardsControlAssociation[];
+}
+
 export interface BatchImportFindingsRequest {
   /**
    * <p>A list of findings to import. To successfully import a finding, it must follow the
@@ -9730,9 +10024,80 @@ export interface BatchUpdateFindingsResponse {
   UnprocessedFindings: BatchUpdateFindingsUnprocessedFinding[] | undefined;
 }
 
-export enum ControlStatus {
-  DISABLED = "DISABLED",
-  ENABLED = "ENABLED",
+/**
+ * <p>An array of requested updates to the enablement status of controls in specified
+ *          standards. The objects in the array include a security control ID, the Amazon Resource Name (ARN) of the standard, the requested
+ *          enablement status, and the reason for updating the enablement status.</p>
+ */
+export interface StandardsControlAssociationUpdate {
+  /**
+   * <p>The Amazon Resource Name (ARN) of the standard in which you want to update the
+   *          control's enablement status.</p>
+   */
+  StandardsArn: string | undefined;
+
+  /**
+   * <p>The unique identifier for the security control whose enablement status you want to update.</p>
+   */
+  SecurityControlId: string | undefined;
+
+  /**
+   * <p>The desired enablement status of the control in the standard.</p>
+   */
+  AssociationStatus: AssociationStatus | string | undefined;
+
+  /**
+   * <p>The reason for updating the control's enablement status in the standard.</p>
+   */
+  UpdatedReason?: string;
+}
+
+export interface BatchUpdateStandardsControlAssociationsRequest {
+  /**
+   * <p>
+   *          Updates the enablement status of a security control in a specified standard.
+   *       </p>
+   */
+  StandardsControlAssociationUpdates: StandardsControlAssociationUpdate[] | undefined;
+}
+
+/**
+ * <p>Provides details about which control's enablement status could not be updated in a
+ *          specified standard when calling the <a href="https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchUpdateStandardsControlAssociations.html">BatchUpdateStandardsControlAssociations</a> API. This parameter also provides
+ *          details about why the request was unprocessed. </p>
+ */
+export interface UnprocessedStandardsControlAssociationUpdate {
+  /**
+   * <p>An array of control and standard associations for which an update failed when calling
+   *          <a href="https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchUpdateStandardsControlAssociations.html">BatchUpdateStandardsControlAssociations</a>.
+   *       </p>
+   */
+  StandardsControlAssociationUpdate: StandardsControlAssociationUpdate | undefined;
+
+  /**
+   * <p>The error code for the unprocessed update of the control's enablement status in the
+   *          specified standard.</p>
+   */
+  ErrorCode: UnprocessedErrorCode | string | undefined;
+
+  /**
+   * <p>The reason why a control's enablement status in the specified standard couldn't be updated. </p>
+   */
+  ErrorReason?: string;
+}
+
+export interface BatchUpdateStandardsControlAssociationsResponse {
+  /**
+   * <p>
+   *          A security control (identified with <code>SecurityControlId</code>, <code>SecurityControlArn</code>, or a mix of both parameters) whose enablement status in a specified standard couldn't be updated.
+   *       </p>
+   */
+  UnprocessedAssociationUpdates?: UnprocessedStandardsControlAssociationUpdate[];
+}
+
+export enum ControlFindingGenerator {
+  SECURITY_CONTROL = "SECURITY_CONTROL",
+  STANDARD_CONTROL = "STANDARD_CONTROL",
 }
 
 export interface CreateActionTargetRequest {
@@ -9754,7 +10119,7 @@ export interface CreateActionTargetRequest {
 
 export interface CreateActionTargetResponse {
   /**
-   * <p>The ARN for the custom action target.</p>
+   * <p>The Amazon Resource Name (ARN) for the custom action target.</p>
    */
   ActionTargetArn: string | undefined;
 }
@@ -9914,7 +10279,7 @@ export interface DeclineInvitationsResponse {
 
 export interface DeleteActionTargetRequest {
   /**
-   * <p>The ARN of the custom action target to delete.</p>
+   * <p>The Amazon Resource Name (ARN) of the custom action target to delete.</p>
    */
   ActionTargetArn: string | undefined;
 }
@@ -9926,242 +10291,12 @@ export interface DeleteActionTargetResponse {
   ActionTargetArn: string | undefined;
 }
 
-export interface DeleteFindingAggregatorRequest {
-  /**
-   * <p>The ARN of the finding aggregator to delete. To obtain the ARN, use <code>ListFindingAggregators</code>.</p>
-   */
-  FindingAggregatorArn: string | undefined;
-}
-
-export interface DeleteFindingAggregatorResponse {}
-
-export interface DeleteInsightRequest {
-  /**
-   * <p>The ARN of the insight to delete.</p>
-   */
-  InsightArn: string | undefined;
-}
-
-export interface DeleteInsightResponse {
-  /**
-   * <p>The ARN of the insight that was deleted.</p>
-   */
-  InsightArn: string | undefined;
-}
-
-export interface DeleteInvitationsRequest {
-  /**
-   * <p>The list of the account IDs that sent the invitations to delete.</p>
-   */
-  AccountIds: string[] | undefined;
-}
-
-export interface DeleteInvitationsResponse {
-  /**
-   * <p>The list of Amazon Web Services accounts for which the invitations were not deleted. For each account,
-   *          the list includes the account ID and the email address.</p>
-   */
-  UnprocessedAccounts?: Result[];
-}
-
-export interface DeleteMembersRequest {
-  /**
-   * <p>The list of account IDs for the member accounts to delete.</p>
-   */
-  AccountIds: string[] | undefined;
-}
-
-export interface DeleteMembersResponse {
-  /**
-   * <p>The list of Amazon Web Services accounts that were not deleted. For each account, the list includes the
-   *          account ID and the email address.</p>
-   */
-  UnprocessedAccounts?: Result[];
-}
-
-export interface DescribeActionTargetsRequest {
-  /**
-   * <p>A list of custom action target ARNs for the custom action targets to retrieve.</p>
-   */
-  ActionTargetArns?: string[];
-
-  /**
-   * <p>The token that is required for pagination. On your first call to the
-   *             <code>DescribeActionTargets</code> operation, set the value of this parameter to
-   *             <code>NULL</code>.</p>
-   *          <p>For subsequent calls to the operation, to continue listing data, set the value of this
-   *          parameter to the value returned from the previous response.</p>
-   */
-  NextToken?: string;
-
-  /**
-   * <p>The maximum number of results to return.</p>
-   */
-  MaxResults?: number;
-}
-
-export interface DescribeActionTargetsResponse {
-  /**
-   * <p>A list of <code>ActionTarget</code> objects. Each object includes the <code>ActionTargetArn</code>,
-   *             <code>Description</code>, and <code>Name</code> of a custom action target available in
-   *          Security Hub.</p>
-   */
-  ActionTargets: ActionTarget[] | undefined;
-
-  /**
-   * <p>The pagination token to use to request the next page of results.</p>
-   */
-  NextToken?: string;
-}
-
-export interface DescribeHubRequest {
-  /**
-   * <p>The ARN of the Hub resource to retrieve.</p>
-   */
-  HubArn?: string;
-}
-
-export interface DescribeHubResponse {
-  /**
-   * <p>The ARN of the Hub resource that was retrieved.</p>
-   */
-  HubArn?: string;
-
-  /**
-   * <p>The date and time when Security Hub was enabled in the account.</p>
-   */
-  SubscribedAt?: string;
-
-  /**
-   * <p>Whether to automatically enable new controls when they are added to standards that are
-   *          enabled.</p>
-   *          <p>If set to <code>true</code>, then new controls for enabled standards are enabled
-   *          automatically. If set to <code>false</code>, then new controls are not enabled.</p>
-   */
-  AutoEnableControls?: boolean;
-}
-
-export interface DescribeOrganizationConfigurationRequest {}
-
-export interface DescribeOrganizationConfigurationResponse {
-  /**
-   * <p>Whether to automatically enable Security Hub for new accounts in the organization.</p>
-   *          <p>If set to <code>true</code>, then Security Hub is enabled for new accounts. If set to false,
-   *          then new accounts are not added automatically.</p>
-   */
-  AutoEnable?: boolean;
-
-  /**
-   * <p>Whether the maximum number of allowed member accounts are already associated with the
-   *          Security Hub administrator account.</p>
-   */
-  MemberAccountLimitReached?: boolean;
-
-  /**
-   * <p>Whether to automatically enable Security Hub <a href="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-enable-disable.html">default standards</a>
-   *          for new member accounts in the organization.</p>
-   *          <p>The default value of this parameter is equal to <code>DEFAULT</code>.</p>
-   *          <p>If equal to <code>DEFAULT</code>, then Security Hub default standards are automatically enabled for new member
-   *          accounts. If equal to <code>NONE</code>, then default standards are not automatically enabled for new member
-   *          accounts.</p>
-   */
-  AutoEnableStandards?: AutoEnableStandards | string;
-}
-
-export interface DescribeProductsRequest {
-  /**
-   * <p>The token that is required for pagination. On your first call to the
-   *             <code>DescribeProducts</code> operation, set the value of this parameter to
-   *             <code>NULL</code>.</p>
-   *          <p>For subsequent calls to the operation, to continue listing data, set the value of this
-   *          parameter to the value returned from the previous response.</p>
-   */
-  NextToken?: string;
-
-  /**
-   * <p>The maximum number of results to return.</p>
-   */
-  MaxResults?: number;
-
-  /**
-   * <p>The ARN of the integration to return.</p>
-   */
-  ProductArn?: string;
-}
-
-export enum IntegrationType {
-  RECEIVE_FINDINGS_FROM_SECURITY_HUB = "RECEIVE_FINDINGS_FROM_SECURITY_HUB",
-  SEND_FINDINGS_TO_SECURITY_HUB = "SEND_FINDINGS_TO_SECURITY_HUB",
-  UPDATE_FINDINGS_IN_SECURITY_HUB = "UPDATE_FINDINGS_IN_SECURITY_HUB",
-}
-
 /**
- * <p>Contains details about a product.</p>
+ * @internal
  */
-export interface Product {
-  /**
-   * <p>The ARN assigned to the product.</p>
-   */
-  ProductArn: string | undefined;
-
-  /**
-   * <p>The name of the product.</p>
-   */
-  ProductName?: string;
-
-  /**
-   * <p>The name of the company that provides the product.</p>
-   */
-  CompanyName?: string;
-
-  /**
-   * <p>A description of the product.</p>
-   */
-  Description?: string;
-
-  /**
-   * <p>The categories assigned to the product.</p>
-   */
-  Categories?: string[];
-
-  /**
-   * <p>The types of integration that the product supports. Available values are the
-   *          following.</p>
-   *          <ul>
-   *             <li>
-   *                <p>
-   *                   <code>SEND_FINDINGS_TO_SECURITY_HUB</code> - The integration sends
-   *                findings to Security Hub.</p>
-   *             </li>
-   *             <li>
-   *                <p>
-   *                   <code>RECEIVE_FINDINGS_FROM_SECURITY_HUB</code> - The integration
-   *                receives findings from Security Hub.</p>
-   *             </li>
-   *             <li>
-   *                <p>
-   *                   <code>UPDATE_FINDINGS_IN_SECURITY_HUB</code> - The integration does not send new findings to Security Hub, but does make updates to the findings that it receives from Security Hub.</p>
-   *             </li>
-   *          </ul>
-   */
-  IntegrationTypes?: (IntegrationType | string)[];
-
-  /**
-   * <p>For integrations with Amazon Web Services services, the Amazon Web Services Console URL from which to activate the service.</p>
-   *          <p>For integrations with third-party products, the Amazon Web Services Marketplace URL from which to subscribe to or purchase the product.</p>
-   */
-  MarketplaceUrl?: string;
-
-  /**
-   * <p>The URL to the service or product documentation about the integration with Security Hub, including how to activate the integration.</p>
-   */
-  ActivationUrl?: string;
-
-  /**
-   * <p>The resource policy associated with the product.</p>
-   */
-  ProductSubscriptionResourcePolicy?: string;
-}
+export const AwsIamGroupPolicyFilterSensitiveLog = (obj: AwsIamGroupPolicy): any => ({
+  ...obj,
+});
 
 /**
  * @internal
@@ -11998,57 +12133,43 @@ export const BatchEnableStandardsResponseFilterSensitiveLog = (obj: BatchEnableS
 /**
  * @internal
  */
-export const BatchImportFindingsRequestFilterSensitiveLog = (obj: BatchImportFindingsRequest): any => ({
+export const BatchGetSecurityControlsRequestFilterSensitiveLog = (obj: BatchGetSecurityControlsRequest): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const ImportFindingsErrorFilterSensitiveLog = (obj: ImportFindingsError): any => ({
+export const SecurityControlFilterSensitiveLog = (obj: SecurityControl): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const BatchImportFindingsResponseFilterSensitiveLog = (obj: BatchImportFindingsResponse): any => ({
+export const UnprocessedSecurityControlFilterSensitiveLog = (obj: UnprocessedSecurityControl): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const NoteUpdateFilterSensitiveLog = (obj: NoteUpdate): any => ({
+export const BatchGetSecurityControlsResponseFilterSensitiveLog = (obj: BatchGetSecurityControlsResponse): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const SeverityUpdateFilterSensitiveLog = (obj: SeverityUpdate): any => ({
+export const StandardsControlAssociationIdFilterSensitiveLog = (obj: StandardsControlAssociationId): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const WorkflowUpdateFilterSensitiveLog = (obj: WorkflowUpdate): any => ({
-  ...obj,
-});
-
-/**
- * @internal
- */
-export const BatchUpdateFindingsRequestFilterSensitiveLog = (obj: BatchUpdateFindingsRequest): any => ({
-  ...obj,
-});
-
-/**
- * @internal
- */
-export const BatchUpdateFindingsUnprocessedFindingFilterSensitiveLog = (
-  obj: BatchUpdateFindingsUnprocessedFinding
+export const BatchGetStandardsControlAssociationsRequestFilterSensitiveLog = (
+  obj: BatchGetStandardsControlAssociationsRequest
 ): any => ({
   ...obj,
 });
@@ -12056,213 +12177,214 @@ export const BatchUpdateFindingsUnprocessedFindingFilterSensitiveLog = (
 /**
  * @internal
  */
-export const BatchUpdateFindingsResponseFilterSensitiveLog = (obj: BatchUpdateFindingsResponse): any => ({
-  ...obj,
-});
-
-/**
- * @internal
- */
-export const CreateActionTargetRequestFilterSensitiveLog = (obj: CreateActionTargetRequest): any => ({
+export const StandardsControlAssociationDetailFilterSensitiveLog = (obj: StandardsControlAssociationDetail): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const CreateActionTargetResponseFilterSensitiveLog = (obj: CreateActionTargetResponse): any => ({
+export const UnprocessedStandardsControlAssociationFilterSensitiveLog = (
+  obj: UnprocessedStandardsControlAssociation
+): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const CreateFindingAggregatorRequestFilterSensitiveLog = (obj: CreateFindingAggregatorRequest): any => ({
+export const BatchGetStandardsControlAssociationsResponseFilterSensitiveLog = (
+  obj: BatchGetStandardsControlAssociationsResponse
+): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const CreateFindingAggregatorResponseFilterSensitiveLog = (obj: CreateFindingAggregatorResponse): any => ({
+export const BatchImportFindingsRequestFilterSensitiveLog = (obj: BatchImportFindingsRequest): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const CreateInsightRequestFilterSensitiveLog = (obj: CreateInsightRequest): any => ({
+export const ImportFindingsErrorFilterSensitiveLog = (obj: ImportFindingsError): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const CreateInsightResponseFilterSensitiveLog = (obj: CreateInsightResponse): any => ({
+export const BatchImportFindingsResponseFilterSensitiveLog = (obj: BatchImportFindingsResponse): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const CreateMembersRequestFilterSensitiveLog = (obj: CreateMembersRequest): any => ({
+export const NoteUpdateFilterSensitiveLog = (obj: NoteUpdate): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const ResultFilterSensitiveLog = (obj: Result): any => ({
+export const SeverityUpdateFilterSensitiveLog = (obj: SeverityUpdate): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const CreateMembersResponseFilterSensitiveLog = (obj: CreateMembersResponse): any => ({
+export const WorkflowUpdateFilterSensitiveLog = (obj: WorkflowUpdate): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const DeclineInvitationsRequestFilterSensitiveLog = (obj: DeclineInvitationsRequest): any => ({
+export const BatchUpdateFindingsRequestFilterSensitiveLog = (obj: BatchUpdateFindingsRequest): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const DeclineInvitationsResponseFilterSensitiveLog = (obj: DeclineInvitationsResponse): any => ({
+export const BatchUpdateFindingsUnprocessedFindingFilterSensitiveLog = (
+  obj: BatchUpdateFindingsUnprocessedFinding
+): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const DeleteActionTargetRequestFilterSensitiveLog = (obj: DeleteActionTargetRequest): any => ({
+export const BatchUpdateFindingsResponseFilterSensitiveLog = (obj: BatchUpdateFindingsResponse): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const DeleteActionTargetResponseFilterSensitiveLog = (obj: DeleteActionTargetResponse): any => ({
+export const StandardsControlAssociationUpdateFilterSensitiveLog = (obj: StandardsControlAssociationUpdate): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const DeleteFindingAggregatorRequestFilterSensitiveLog = (obj: DeleteFindingAggregatorRequest): any => ({
+export const BatchUpdateStandardsControlAssociationsRequestFilterSensitiveLog = (
+  obj: BatchUpdateStandardsControlAssociationsRequest
+): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const DeleteFindingAggregatorResponseFilterSensitiveLog = (obj: DeleteFindingAggregatorResponse): any => ({
+export const UnprocessedStandardsControlAssociationUpdateFilterSensitiveLog = (
+  obj: UnprocessedStandardsControlAssociationUpdate
+): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const DeleteInsightRequestFilterSensitiveLog = (obj: DeleteInsightRequest): any => ({
+export const BatchUpdateStandardsControlAssociationsResponseFilterSensitiveLog = (
+  obj: BatchUpdateStandardsControlAssociationsResponse
+): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const DeleteInsightResponseFilterSensitiveLog = (obj: DeleteInsightResponse): any => ({
+export const CreateActionTargetRequestFilterSensitiveLog = (obj: CreateActionTargetRequest): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const DeleteInvitationsRequestFilterSensitiveLog = (obj: DeleteInvitationsRequest): any => ({
+export const CreateActionTargetResponseFilterSensitiveLog = (obj: CreateActionTargetResponse): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const DeleteInvitationsResponseFilterSensitiveLog = (obj: DeleteInvitationsResponse): any => ({
+export const CreateFindingAggregatorRequestFilterSensitiveLog = (obj: CreateFindingAggregatorRequest): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const DeleteMembersRequestFilterSensitiveLog = (obj: DeleteMembersRequest): any => ({
+export const CreateFindingAggregatorResponseFilterSensitiveLog = (obj: CreateFindingAggregatorResponse): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const DeleteMembersResponseFilterSensitiveLog = (obj: DeleteMembersResponse): any => ({
+export const CreateInsightRequestFilterSensitiveLog = (obj: CreateInsightRequest): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const DescribeActionTargetsRequestFilterSensitiveLog = (obj: DescribeActionTargetsRequest): any => ({
+export const CreateInsightResponseFilterSensitiveLog = (obj: CreateInsightResponse): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const DescribeActionTargetsResponseFilterSensitiveLog = (obj: DescribeActionTargetsResponse): any => ({
+export const CreateMembersRequestFilterSensitiveLog = (obj: CreateMembersRequest): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const DescribeHubRequestFilterSensitiveLog = (obj: DescribeHubRequest): any => ({
+export const ResultFilterSensitiveLog = (obj: Result): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const DescribeHubResponseFilterSensitiveLog = (obj: DescribeHubResponse): any => ({
+export const CreateMembersResponseFilterSensitiveLog = (obj: CreateMembersResponse): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const DescribeOrganizationConfigurationRequestFilterSensitiveLog = (
-  obj: DescribeOrganizationConfigurationRequest
-): any => ({
+export const DeclineInvitationsRequestFilterSensitiveLog = (obj: DeclineInvitationsRequest): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const DescribeOrganizationConfigurationResponseFilterSensitiveLog = (
-  obj: DescribeOrganizationConfigurationResponse
-): any => ({
+export const DeclineInvitationsResponseFilterSensitiveLog = (obj: DeclineInvitationsResponse): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const DescribeProductsRequestFilterSensitiveLog = (obj: DescribeProductsRequest): any => ({
+export const DeleteActionTargetRequestFilterSensitiveLog = (obj: DeleteActionTargetRequest): any => ({
   ...obj,
 });
 
 /**
  * @internal
  */
-export const ProductFilterSensitiveLog = (obj: Product): any => ({
+export const DeleteActionTargetResponseFilterSensitiveLog = (obj: DeleteActionTargetResponse): any => ({
   ...obj,
 });
diff --git a/clients/client-securityhub/src/models/models_2.ts b/clients/client-securityhub/src/models/models_2.ts
index 89326ecfc890..eee09884dfb0 100644
--- a/clients/client-securityhub/src/models/models_2.ts
+++ b/clients/client-securityhub/src/models/models_2.ts
@@ -1,16 +1,267 @@
 // smithy-typescript generated code
-import { AdminAccount, AutoEnableStandards } from "./models_0";
+import { ActionTarget, AdminAccount, AssociationStatus, AutoEnableStandards } from "./models_0";
 import {
   AwsSecurityFinding,
   AwsSecurityFindingFilters,
+  ControlFindingGenerator,
   ControlStatus,
   NoteUpdate,
-  Product,
   RecordState,
   Result,
+  SeverityRating,
   StandardsSubscription,
 } from "./models_1";
 
+export interface DeleteFindingAggregatorRequest {
+  /**
+   * <p>The ARN of the finding aggregator to delete. To obtain the ARN, use <code>ListFindingAggregators</code>.</p>
+   */
+  FindingAggregatorArn: string | undefined;
+}
+
+export interface DeleteFindingAggregatorResponse {}
+
+export interface DeleteInsightRequest {
+  /**
+   * <p>The ARN of the insight to delete.</p>
+   */
+  InsightArn: string | undefined;
+}
+
+export interface DeleteInsightResponse {
+  /**
+   * <p>The ARN of the insight that was deleted.</p>
+   */
+  InsightArn: string | undefined;
+}
+
+export interface DeleteInvitationsRequest {
+  /**
+   * <p>The list of the account IDs that sent the invitations to delete.</p>
+   */
+  AccountIds: string[] | undefined;
+}
+
+export interface DeleteInvitationsResponse {
+  /**
+   * <p>The list of Amazon Web Services accounts for which the invitations were not deleted. For each account,
+   *          the list includes the account ID and the email address.</p>
+   */
+  UnprocessedAccounts?: Result[];
+}
+
+export interface DeleteMembersRequest {
+  /**
+   * <p>The list of account IDs for the member accounts to delete.</p>
+   */
+  AccountIds: string[] | undefined;
+}
+
+export interface DeleteMembersResponse {
+  /**
+   * <p>The list of Amazon Web Services accounts that were not deleted. For each account, the list includes the
+   *          account ID and the email address.</p>
+   */
+  UnprocessedAccounts?: Result[];
+}
+
+export interface DescribeActionTargetsRequest {
+  /**
+   * <p>A list of custom action target ARNs for the custom action targets to retrieve.</p>
+   */
+  ActionTargetArns?: string[];
+
+  /**
+   * <p>The token that is required for pagination. On your first call to the
+   *             <code>DescribeActionTargets</code> operation, set the value of this parameter to
+   *             <code>NULL</code>.</p>
+   *          <p>For subsequent calls to the operation, to continue listing data, set the value of this
+   *          parameter to the value returned from the previous response.</p>
+   */
+  NextToken?: string;
+
+  /**
+   * <p>The maximum number of results to return.</p>
+   */
+  MaxResults?: number;
+}
+
+export interface DescribeActionTargetsResponse {
+  /**
+   * <p>A list of <code>ActionTarget</code> objects. Each object includes the <code>ActionTargetArn</code>,
+   *             <code>Description</code>, and <code>Name</code> of a custom action target available in
+   *          Security Hub.</p>
+   */
+  ActionTargets: ActionTarget[] | undefined;
+
+  /**
+   * <p>The pagination token to use to request the next page of results.</p>
+   */
+  NextToken?: string;
+}
+
+export interface DescribeHubRequest {
+  /**
+   * <p>The ARN of the Hub resource to retrieve.</p>
+   */
+  HubArn?: string;
+}
+
+export interface DescribeHubResponse {
+  /**
+   * <p>The ARN of the Hub resource that was retrieved.</p>
+   */
+  HubArn?: string;
+
+  /**
+   * <p>The date and time when Security Hub was enabled in the account.</p>
+   */
+  SubscribedAt?: string;
+
+  /**
+   * <p>Whether to automatically enable new controls when they are added to standards that are
+   *          enabled.</p>
+   *          <p>If set to <code>true</code>, then new controls for enabled standards are enabled
+   *          automatically. If set to <code>false</code>, then new controls are not enabled.</p>
+   */
+  AutoEnableControls?: boolean;
+
+  /**
+   * <p>Specifies whether the calling account has consolidated control findings turned on. If the value for this field is set to
+   *          <code>SECURITY_CONTROL</code>, Security Hub generates a single finding for a control check even when the check
+   *          applies to multiple enabled standards.</p>
+   *          <p>If the value for this field is set to <code>STANDARD_CONTROL</code>, Security Hub generates separate findings
+   *          for a control check when the check applies to multiple enabled standards.</p>
+   *          <p>The value for this field in a member account matches the value in the administrator
+   *          account. For accounts that aren't part of an organization, the default value of this field
+   *          is <code>SECURITY_CONTROL</code> if you enabled Security Hub on or after February 9,
+   *          2023.</p>
+   */
+  ControlFindingGenerator?: ControlFindingGenerator | string;
+}
+
+export interface DescribeOrganizationConfigurationRequest {}
+
+export interface DescribeOrganizationConfigurationResponse {
+  /**
+   * <p>Whether to automatically enable Security Hub for new accounts in the organization.</p>
+   *          <p>If set to <code>true</code>, then Security Hub is enabled for new accounts. If set to false,
+   *          then new accounts are not added automatically.</p>
+   */
+  AutoEnable?: boolean;
+
+  /**
+   * <p>Whether the maximum number of allowed member accounts are already associated with the
+   *          Security Hub administrator account.</p>
+   */
+  MemberAccountLimitReached?: boolean;
+
+  /**
+   * <p>Whether to automatically enable Security Hub <a href="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-enable-disable.html">default standards</a>
+   *          for new member accounts in the organization.</p>
+   *          <p>The default value of this parameter is equal to <code>DEFAULT</code>.</p>
+   *          <p>If equal to <code>DEFAULT</code>, then Security Hub default standards are automatically enabled for new member
+   *          accounts. If equal to <code>NONE</code>, then default standards are not automatically enabled for new member
+   *          accounts.</p>
+   */
+  AutoEnableStandards?: AutoEnableStandards | string;
+}
+
+export interface DescribeProductsRequest {
+  /**
+   * <p>The token that is required for pagination. On your first call to the
+   *             <code>DescribeProducts</code> operation, set the value of this parameter to
+   *             <code>NULL</code>.</p>
+   *          <p>For subsequent calls to the operation, to continue listing data, set the value of this
+   *          parameter to the value returned from the previous response.</p>
+   */
+  NextToken?: string;
+
+  /**
+   * <p>The maximum number of results to return.</p>
+   */
+  MaxResults?: number;
+
+  /**
+   * <p>The ARN of the integration to return.</p>
+   */
+  ProductArn?: string;
+}
+
+export enum IntegrationType {
+  RECEIVE_FINDINGS_FROM_SECURITY_HUB = "RECEIVE_FINDINGS_FROM_SECURITY_HUB",
+  SEND_FINDINGS_TO_SECURITY_HUB = "SEND_FINDINGS_TO_SECURITY_HUB",
+  UPDATE_FINDINGS_IN_SECURITY_HUB = "UPDATE_FINDINGS_IN_SECURITY_HUB",
+}
+
+/**
+ * <p>Contains details about a product.</p>
+ */
+export interface Product {
+  /**
+   * <p>The ARN assigned to the product.</p>
+   */
+  ProductArn: string | undefined;
+
+  /**
+   * <p>The name of the product.</p>
+   */
+  ProductName?: string;
+
+  /**
+   * <p>The name of the company that provides the product.</p>
+   */
+  CompanyName?: string;
+
+  /**
+   * <p>A description of the product.</p>
+   */
+  Description?: string;
+
+  /**
+   * <p>The categories assigned to the product.</p>
+   */
+  Categories?: string[];
+
+  /**
+   * <p>The types of integration that the product supports. Available values are the
+   *          following.</p>
+   *          <ul>
+   *             <li>
+   *                <p>
+   *                   <code>SEND_FINDINGS_TO_SECURITY_HUB</code> - The integration sends
+   *                findings to Security Hub.</p>
+   *             </li>
+   *             <li>
+   *                <p>
+   *                   <code>RECEIVE_FINDINGS_FROM_SECURITY_HUB</code> - The integration
+   *                receives findings from Security Hub.</p>
+   *             </li>
+   *             <li>
+   *                <p>
+   *                   <code>UPDATE_FINDINGS_IN_SECURITY_HUB</code> - The integration does not send new findings to Security Hub, but does make updates to the findings that it receives from Security Hub.</p>
+   *             </li>
+   *          </ul>
+   */
+  IntegrationTypes?: (IntegrationType | string)[];
+
+  /**
+   * <p>For integrations with Amazon Web Services services, the Amazon Web Services Console URL from which to activate the service.</p>
+   *          <p>For integrations with third-party products, the Amazon Web Services Marketplace URL from which to subscribe to or purchase the product.</p>
+   */
+  MarketplaceUrl?: string;
+
+  /**
+   * <p>The URL to the service or product documentation about the integration with Security Hub, including how to activate the integration.</p>
+   */
+  ActivationUrl?: string;
+
+  /**
+   * <p>The resource policy associated with the product.</p>
+   */
+  ProductSubscriptionResourcePolicy?: string;
+}
+
 export interface DescribeProductsResponse {
   /**
    * <p>A list of products, including details for each product.</p>
@@ -127,13 +378,6 @@ export interface DescribeStandardsControlsRequest {
   MaxResults?: number;
 }
 
-export enum SeverityRating {
-  CRITICAL = "CRITICAL",
-  HIGH = "HIGH",
-  LOW = "LOW",
-  MEDIUM = "MEDIUM",
-}
-
 /**
  * <p>Details for an individual security standard control.</p>
  */
@@ -283,6 +527,20 @@ export interface EnableSecurityHubRequest {
    *             <code>EnableDefaultStandards</code> to <code>false</code>.</p>
    */
   EnableDefaultStandards?: boolean;
+
+  /**
+   * <p>This field, used when enabling Security Hub, specifies whether the calling account has consolidated control findings turned on.
+   *       If the value for this field is set to
+   *       <code>SECURITY_CONTROL</code>, Security Hub generates a single finding for a control check even when the check
+   *       applies to multiple enabled standards.</p>
+   *          <p>If the value for this field is set to <code>STANDARD_CONTROL</code>, Security Hub generates separate findings
+   *       for a control check when the check applies to multiple enabled standards.</p>
+   *          <p>The value for this field in a member account matches the value in the administrator
+   *          account. For accounts that aren't part of an organization, the default value of this field
+   *          is <code>SECURITY_CONTROL</code> if you enabled Security Hub on or after February 9,
+   *          2023.</p>
+   */
+  ControlFindingGenerator?: ControlFindingGenerator | string;
 }
 
 export interface EnableSecurityHubResponse {}
@@ -860,6 +1118,215 @@ export interface ListOrganizationAdminAccountsResponse {
   NextToken?: string;
 }
 
+export interface ListSecurityControlDefinitionsRequest {
+  /**
+   * <p>
+   *          The Amazon Resource Name (ARN) of the standard that you want to view controls for.
+   *       </p>
+   */
+  StandardsArn?: string;
+
+  /**
+   * <p>
+   *          Optional pagination parameter.
+   *       </p>
+   */
+  NextToken?: string;
+
+  /**
+   * <p> An optional parameter that limits the total results of the API response to the
+   *          specified number. If this parameter isn't provided in the request, the results include the
+   *          first 25 security controls that apply to the specified standard. The results also include a
+   *             <code>NextToken</code> parameter that you can use in a subsequent API call to get the
+   *          next 25 controls. This repeats until all controls for the standard are returned. </p>
+   */
+  MaxResults?: number;
+}
+
+export enum RegionAvailabilityStatus {
+  AVAILABLE = "AVAILABLE",
+  UNAVAILABLE = "UNAVAILABLE",
+}
+
+/**
+ * <p>
+ *          Provides metadata for a security control, including its unique standard-agnostic identifier, title, description,
+ *          severity, availability in Amazon Web Services Regions, and a link to remediation steps.
+ *       </p>
+ */
+export interface SecurityControlDefinition {
+  /**
+   * <p>
+   *          The unique identifier of a security control across standards. Values for this field typically consist of an
+   *          Amazon Web Service name and a number (for example, APIGateway.3). This parameter differs from
+   *          <code>SecurityControlArn</code>, which is a unique Amazon Resource Name (ARN) assigned to a control. The
+   *          ARN references the security control ID (for example, arn:aws:securityhub:eu-central-1:123456789012:security-control/APIGateway.3).
+   *       </p>
+   */
+  SecurityControlId: string | undefined;
+
+  /**
+   * <p>
+   *          The title of a security control.
+   *       </p>
+   */
+  Title: string | undefined;
+
+  /**
+   * <p> The description of a security control across standards. This typically summarizes how
+   *             Security Hub evaluates the control and the conditions under which it produces a
+   *          failed finding. This parameter doesn't reference a specific standard. </p>
+   */
+  Description: string | undefined;
+
+  /**
+   * <p>
+   *          A link to Security Hub documentation that explains how to remediate a failed finding for a security control.
+   *       </p>
+   */
+  RemediationUrl: string | undefined;
+
+  /**
+   * <p>
+   *          The severity of a security control. For more information about how Security Hub determines control severity,
+   *          see <a href="https://docs.aws.amazon.com/securityhub/latest/userguide/controls-findings-create-update.html#control-findings-severity">Assigning severity to control findings</a> in the
+   *          <i>Security Hub User Guide</i>.
+   *       </p>
+   */
+  SeverityRating: SeverityRating | string | undefined;
+
+  /**
+   * <p>
+   *          Specifies whether a security control is available in the current Amazon Web Services Region.
+   *       </p>
+   */
+  CurrentRegionAvailability: RegionAvailabilityStatus | string | undefined;
+}
+
+export interface ListSecurityControlDefinitionsResponse {
+  /**
+   * <p>
+   *          An array of controls that apply to the specified standard.
+   *       </p>
+   */
+  SecurityControlDefinitions: SecurityControlDefinition[] | undefined;
+
+  /**
+   * <p> A pagination parameter that's included in the response only if it was included in the
+   *          request. </p>
+   */
+  NextToken?: string;
+}
+
+export interface ListStandardsControlAssociationsRequest {
+  /**
+   * <p>
+   *          The identifier of the control (identified with <code>SecurityControlId</code>, <code>SecurityControlArn</code>, or a mix of both parameters) that you
+   *          want to determine the enablement status of in each enabled standard.
+   *       </p>
+   */
+  SecurityControlId: string | undefined;
+
+  /**
+   * <p>
+   *          Optional pagination parameter.
+   *       </p>
+   */
+  NextToken?: string;
+
+  /**
+   * <p> An optional parameter that limits the total results of the API response to the
+   *          specified number. If this parameter isn't provided in the request, the results include the
+   *          first 25 standard and control associations. The results also include a
+   *             <code>NextToken</code> parameter that you can use in a subsequent API call to get the
+   *          next 25 associations. This repeats until all associations for the specified control are
+   *          returned. The number of results is limited by the number of supported Security Hub
+   *          standards that you've enabled in the calling account. </p>
+   */
+  MaxResults?: number;
+}
+
+/**
+ * <p> An array that provides the enablement status and other details for each control that
+ *          applies to each enabled standard. </p>
+ */
+export interface StandardsControlAssociationSummary {
+  /**
+   * <p>
+   *          The Amazon Resource Name (ARN) of a standard.
+   *       </p>
+   */
+  StandardsArn: string | undefined;
+
+  /**
+   * <p>
+   *          A unique standard-agnostic identifier for a control. Values for this field typically consist of an
+   *          Amazon Web Service and a number, such as APIGateway.5. This field doesn't reference a specific standard.
+   *       </p>
+   */
+  SecurityControlId: string | undefined;
+
+  /**
+   * <p> The ARN of a control, such as
+   *             <code>arn:aws:securityhub:eu-central-1:123456789012:security-control/S3.1</code>. This
+   *          parameter doesn't mention a specific standard. </p>
+   */
+  SecurityControlArn: string | undefined;
+
+  /**
+   * <p>
+   *          The enablement status of a control in a specific standard.
+   *       </p>
+   */
+  AssociationStatus: AssociationStatus | string | undefined;
+
+  /**
+   * <p>
+   *          The requirement that underlies this control in the compliance framework related to the standard.
+   *       </p>
+   */
+  RelatedRequirements?: string[];
+
+  /**
+   * <p> The last time that a control's enablement status in a specified standard was updated. </p>
+   */
+  UpdatedAt?: Date;
+
+  /**
+   * <p> The reason for updating the control's enablement status in a specified standard. </p>
+   */
+  UpdatedReason?: string;
+
+  /**
+   * <p>
+   *          The title of a control.
+   *       </p>
+   */
+  StandardsControlTitle?: string;
+
+  /**
+   * <p>
+   *          The description of a control. This typically summarizes how Security Hub evaluates the control and the
+   *          conditions under which it produces a failed finding. The parameter may reference a specific standard.
+   *       </p>
+   */
+  StandardsControlDescription?: string;
+}
+
+export interface ListStandardsControlAssociationsResponse {
+  /**
+   * <p> An array that provides the enablement status and other details for each security
+   *          control that applies to each enabled standard. </p>
+   */
+  StandardsControlAssociationSummaries: StandardsControlAssociationSummary[] | undefined;
+
+  /**
+   * <p> A pagination parameter that's included in the response only if it was included in the
+   *          request. </p>
+   */
+  NextToken?: string;
+}
+
 export interface ListTagsForResourceRequest {
   /**
    * <p>The ARN of the resource to retrieve tags for.</p>
@@ -1052,6 +1519,17 @@ export interface UpdateSecurityHubConfigurationRequest {
    *       </p>
    */
   AutoEnableControls?: boolean;
+
+  /**
+   * <p>Updates whether the calling account has consolidated control findings turned on.
+   *       If the value for this field is set to
+   *       <code>SECURITY_CONTROL</code>, Security Hub generates a single finding for a control check even when the check
+   *       applies to multiple enabled standards.</p>
+   *          <p>If the value for this field is set to <code>STANDARD_CONTROL</code>, Security Hub generates separate findings
+   *       for a control check when the check applies to multiple enabled standards.</p>
+   *          <p>For accounts that are part of an organization, this value can only be updated in the administrator account.</p>
+   */
+  ControlFindingGenerator?: ControlFindingGenerator | string;
 }
 
 export interface UpdateSecurityHubConfigurationResponse {}
@@ -1076,6 +1554,122 @@ export interface UpdateStandardsControlRequest {
 
 export interface UpdateStandardsControlResponse {}
 
+/**
+ * @internal
+ */
+export const DeleteFindingAggregatorRequestFilterSensitiveLog = (obj: DeleteFindingAggregatorRequest): any => ({
+  ...obj,
+});
+
+/**
+ * @internal
+ */
+export const DeleteFindingAggregatorResponseFilterSensitiveLog = (obj: DeleteFindingAggregatorResponse): any => ({
+  ...obj,
+});
+
+/**
+ * @internal
+ */
+export const DeleteInsightRequestFilterSensitiveLog = (obj: DeleteInsightRequest): any => ({
+  ...obj,
+});
+
+/**
+ * @internal
+ */
+export const DeleteInsightResponseFilterSensitiveLog = (obj: DeleteInsightResponse): any => ({
+  ...obj,
+});
+
+/**
+ * @internal
+ */
+export const DeleteInvitationsRequestFilterSensitiveLog = (obj: DeleteInvitationsRequest): any => ({
+  ...obj,
+});
+
+/**
+ * @internal
+ */
+export const DeleteInvitationsResponseFilterSensitiveLog = (obj: DeleteInvitationsResponse): any => ({
+  ...obj,
+});
+
+/**
+ * @internal
+ */
+export const DeleteMembersRequestFilterSensitiveLog = (obj: DeleteMembersRequest): any => ({
+  ...obj,
+});
+
+/**
+ * @internal
+ */
+export const DeleteMembersResponseFilterSensitiveLog = (obj: DeleteMembersResponse): any => ({
+  ...obj,
+});
+
+/**
+ * @internal
+ */
+export const DescribeActionTargetsRequestFilterSensitiveLog = (obj: DescribeActionTargetsRequest): any => ({
+  ...obj,
+});
+
+/**
+ * @internal
+ */
+export const DescribeActionTargetsResponseFilterSensitiveLog = (obj: DescribeActionTargetsResponse): any => ({
+  ...obj,
+});
+
+/**
+ * @internal
+ */
+export const DescribeHubRequestFilterSensitiveLog = (obj: DescribeHubRequest): any => ({
+  ...obj,
+});
+
+/**
+ * @internal
+ */
+export const DescribeHubResponseFilterSensitiveLog = (obj: DescribeHubResponse): any => ({
+  ...obj,
+});
+
+/**
+ * @internal
+ */
+export const DescribeOrganizationConfigurationRequestFilterSensitiveLog = (
+  obj: DescribeOrganizationConfigurationRequest
+): any => ({
+  ...obj,
+});
+
+/**
+ * @internal
+ */
+export const DescribeOrganizationConfigurationResponseFilterSensitiveLog = (
+  obj: DescribeOrganizationConfigurationResponse
+): any => ({
+  ...obj,
+});
+
+/**
+ * @internal
+ */
+export const DescribeProductsRequestFilterSensitiveLog = (obj: DescribeProductsRequest): any => ({
+  ...obj,
+});
+
+/**
+ * @internal
+ */
+export const ProductFilterSensitiveLog = (obj: Product): any => ({
+  ...obj,
+});
+
 /**
  * @internal
  */
@@ -1549,6 +2143,56 @@ export const ListOrganizationAdminAccountsResponseFilterSensitiveLog = (
   ...obj,
 });
 
+/**
+ * @internal
+ */
+export const ListSecurityControlDefinitionsRequestFilterSensitiveLog = (
+  obj: ListSecurityControlDefinitionsRequest
+): any => ({
+  ...obj,
+});
+
+/**
+ * @internal
+ */
+export const SecurityControlDefinitionFilterSensitiveLog = (obj: SecurityControlDefinition): any => ({
+  ...obj,
+});
+
+/**
+ * @internal
+ */
+export const ListSecurityControlDefinitionsResponseFilterSensitiveLog = (
+  obj: ListSecurityControlDefinitionsResponse
+): any => ({
+  ...obj,
+});
+
+/**
+ * @internal
+ */
+export const ListStandardsControlAssociationsRequestFilterSensitiveLog = (
+  obj: ListStandardsControlAssociationsRequest
+): any => ({
+  ...obj,
+});
+
+/**
+ * @internal
+ */
+export const StandardsControlAssociationSummaryFilterSensitiveLog = (obj: StandardsControlAssociationSummary): any => ({
+  ...obj,
+});
+
+/**
+ * @internal
+ */
+export const ListStandardsControlAssociationsResponseFilterSensitiveLog = (
+  obj: ListStandardsControlAssociationsResponse
+): any => ({
+  ...obj,
+});
+
 /**
  * @internal
  */
diff --git a/clients/client-securityhub/src/pagination/ListSecurityControlDefinitionsPaginator.ts b/clients/client-securityhub/src/pagination/ListSecurityControlDefinitionsPaginator.ts
new file mode 100644
index 000000000000..2366cedfc24f
--- /dev/null
+++ b/clients/client-securityhub/src/pagination/ListSecurityControlDefinitionsPaginator.ts
@@ -0,0 +1,61 @@
+// smithy-typescript generated code
+import { Paginator } from "@aws-sdk/types";
+
+import {
+  ListSecurityControlDefinitionsCommand,
+  ListSecurityControlDefinitionsCommandInput,
+  ListSecurityControlDefinitionsCommandOutput,
+} from "../commands/ListSecurityControlDefinitionsCommand";
+import { SecurityHub } from "../SecurityHub";
+import { SecurityHubClient } from "../SecurityHubClient";
+import { SecurityHubPaginationConfiguration } from "./Interfaces";
+
+/**
+ * @private
+ */
+const makePagedClientRequest = async (
+  client: SecurityHubClient,
+  input: ListSecurityControlDefinitionsCommandInput,
+  ...args: any
+): Promise<ListSecurityControlDefinitionsCommandOutput> => {
+  // @ts-ignore
+  return await client.send(new ListSecurityControlDefinitionsCommand(input), ...args);
+};
+/**
+ * @private
+ */
+const makePagedRequest = async (
+  client: SecurityHub,
+  input: ListSecurityControlDefinitionsCommandInput,
+  ...args: any
+): Promise<ListSecurityControlDefinitionsCommandOutput> => {
+  // @ts-ignore
+  return await client.listSecurityControlDefinitions(input, ...args);
+};
+export async function* paginateListSecurityControlDefinitions(
+  config: SecurityHubPaginationConfiguration,
+  input: ListSecurityControlDefinitionsCommandInput,
+  ...additionalArguments: any
+): Paginator<ListSecurityControlDefinitionsCommandOutput> {
+  // ToDo: replace with actual type instead of typeof input.NextToken
+  let token: typeof input.NextToken | undefined = config.startingToken || undefined;
+  let hasNext = true;
+  let page: ListSecurityControlDefinitionsCommandOutput;
+  while (hasNext) {
+    input.NextToken = token;
+    input["MaxResults"] = config.pageSize;
+    if (config.client instanceof SecurityHub) {
+      page = await makePagedRequest(config.client, input, ...additionalArguments);
+    } else if (config.client instanceof SecurityHubClient) {
+      page = await makePagedClientRequest(config.client, input, ...additionalArguments);
+    } else {
+      throw new Error("Invalid client, expected SecurityHub | SecurityHubClient");
+    }
+    yield page;
+    const prevToken = token;
+    token = page.NextToken;
+    hasNext = !!(token && (!config.stopOnSameToken || token !== prevToken));
+  }
+  // @ts-ignore
+  return undefined;
+}
diff --git a/clients/client-securityhub/src/pagination/ListStandardsControlAssociationsPaginator.ts b/clients/client-securityhub/src/pagination/ListStandardsControlAssociationsPaginator.ts
new file mode 100644
index 000000000000..2ee975d89e2e
--- /dev/null
+++ b/clients/client-securityhub/src/pagination/ListStandardsControlAssociationsPaginator.ts
@@ -0,0 +1,61 @@
+// smithy-typescript generated code
+import { Paginator } from "@aws-sdk/types";
+
+import {
+  ListStandardsControlAssociationsCommand,
+  ListStandardsControlAssociationsCommandInput,
+  ListStandardsControlAssociationsCommandOutput,
+} from "../commands/ListStandardsControlAssociationsCommand";
+import { SecurityHub } from "../SecurityHub";
+import { SecurityHubClient } from "../SecurityHubClient";
+import { SecurityHubPaginationConfiguration } from "./Interfaces";
+
+/**
+ * @private
+ */
+const makePagedClientRequest = async (
+  client: SecurityHubClient,
+  input: ListStandardsControlAssociationsCommandInput,
+  ...args: any
+): Promise<ListStandardsControlAssociationsCommandOutput> => {
+  // @ts-ignore
+  return await client.send(new ListStandardsControlAssociationsCommand(input), ...args);
+};
+/**
+ * @private
+ */
+const makePagedRequest = async (
+  client: SecurityHub,
+  input: ListStandardsControlAssociationsCommandInput,
+  ...args: any
+): Promise<ListStandardsControlAssociationsCommandOutput> => {
+  // @ts-ignore
+  return await client.listStandardsControlAssociations(input, ...args);
+};
+export async function* paginateListStandardsControlAssociations(
+  config: SecurityHubPaginationConfiguration,
+  input: ListStandardsControlAssociationsCommandInput,
+  ...additionalArguments: any
+): Paginator<ListStandardsControlAssociationsCommandOutput> {
+  // ToDo: replace with actual type instead of typeof input.NextToken
+  let token: typeof input.NextToken | undefined = config.startingToken || undefined;
+  let hasNext = true;
+  let page: ListStandardsControlAssociationsCommandOutput;
+  while (hasNext) {
+    input.NextToken = token;
+    input["MaxResults"] = config.pageSize;
+    if (config.client instanceof SecurityHub) {
+      page = await makePagedRequest(config.client, input, ...additionalArguments);
+    } else if (config.client instanceof SecurityHubClient) {
+      page = await makePagedClientRequest(config.client, input, ...additionalArguments);
+    } else {
+      throw new Error("Invalid client, expected SecurityHub | SecurityHubClient");
+    }
+    yield page;
+    const prevToken = token;
+    token = page.NextToken;
+    hasNext = !!(token && (!config.stopOnSameToken || token !== prevToken));
+  }
+  // @ts-ignore
+  return undefined;
+}
diff --git a/clients/client-securityhub/src/pagination/index.ts b/clients/client-securityhub/src/pagination/index.ts
index f04a8df52d22..7773c67f2394 100644
--- a/clients/client-securityhub/src/pagination/index.ts
+++ b/clients/client-securityhub/src/pagination/index.ts
@@ -18,3 +18,5 @@ export * from "./ListFindingAggregatorsPaginator";
 export * from "./ListInvitationsPaginator";
 export * from "./ListMembersPaginator";
 export * from "./ListOrganizationAdminAccountsPaginator";
+export * from "./ListSecurityControlDefinitionsPaginator";
+export * from "./ListStandardsControlAssociationsPaginator";
diff --git a/clients/client-securityhub/src/protocols/Aws_restJson1.ts b/clients/client-securityhub/src/protocols/Aws_restJson1.ts
index f50e9b977b24..1ab3cf7302be 100644
--- a/clients/client-securityhub/src/protocols/Aws_restJson1.ts
+++ b/clients/client-securityhub/src/protocols/Aws_restJson1.ts
@@ -35,6 +35,14 @@ import {
   BatchEnableStandardsCommandInput,
   BatchEnableStandardsCommandOutput,
 } from "../commands/BatchEnableStandardsCommand";
+import {
+  BatchGetSecurityControlsCommandInput,
+  BatchGetSecurityControlsCommandOutput,
+} from "../commands/BatchGetSecurityControlsCommand";
+import {
+  BatchGetStandardsControlAssociationsCommandInput,
+  BatchGetStandardsControlAssociationsCommandOutput,
+} from "../commands/BatchGetStandardsControlAssociationsCommand";
 import {
   BatchImportFindingsCommandInput,
   BatchImportFindingsCommandOutput,
@@ -43,6 +51,10 @@ import {
   BatchUpdateFindingsCommandInput,
   BatchUpdateFindingsCommandOutput,
 } from "../commands/BatchUpdateFindingsCommand";
+import {
+  BatchUpdateStandardsControlAssociationsCommandInput,
+  BatchUpdateStandardsControlAssociationsCommandOutput,
+} from "../commands/BatchUpdateStandardsControlAssociationsCommand";
 import { CreateActionTargetCommandInput, CreateActionTargetCommandOutput } from "../commands/CreateActionTargetCommand";
 import {
   CreateFindingAggregatorCommandInput,
@@ -140,6 +152,14 @@ import {
   ListOrganizationAdminAccountsCommandInput,
   ListOrganizationAdminAccountsCommandOutput,
 } from "../commands/ListOrganizationAdminAccountsCommand";
+import {
+  ListSecurityControlDefinitionsCommandInput,
+  ListSecurityControlDefinitionsCommandOutput,
+} from "../commands/ListSecurityControlDefinitionsCommand";
+import {
+  ListStandardsControlAssociationsCommandInput,
+  ListStandardsControlAssociationsCommandOutput,
+} from "../commands/ListStandardsControlAssociationsCommand";
 import {
   ListTagsForResourceCommandInput,
   ListTagsForResourceCommandOutput,
@@ -436,7 +456,6 @@ import {
   AwsIamAccessKeySessionContextAttributes,
   AwsIamAccessKeySessionContextSessionIssuer,
   AwsIamAttachedManagedPolicy,
-  AwsIamGroupPolicy,
   AwsMountPoint,
   CidrBlockAssociation,
   City,
@@ -463,6 +482,7 @@ import {
 import {
   _Record,
   AwsIamGroupDetails,
+  AwsIamGroupPolicy,
   AwsIamInstanceProfile,
   AwsIamInstanceProfileRole,
   AwsIamPermissionsBoundary,
@@ -638,7 +658,6 @@ import {
   FirewallPolicyStatelessCustomActionsDetails,
   FirewallPolicyStatelessRuleGroupReferencesDetails,
   ImportFindingsError,
-  IntegrationType,
   IpFilter,
   KeywordFilter,
   Malware,
@@ -655,7 +674,6 @@ import {
   PatchSummary,
   PortRange,
   ProcessDetails,
-  Product,
   Range,
   Recommendation,
   RelatedFinding,
@@ -683,11 +701,15 @@ import {
   RuleGroupVariables,
   RuleGroupVariablesIpSetsDetails,
   RuleGroupVariablesPortSetsDetails,
+  SecurityControl,
   SensitiveDataDetections,
   SensitiveDataResult,
   Severity,
   SeverityUpdate,
   SoftwarePackage,
+  StandardsControlAssociationDetail,
+  StandardsControlAssociationId,
+  StandardsControlAssociationUpdate,
   StandardsStatusReason,
   StandardsSubscription,
   StandardsSubscriptionRequest,
@@ -698,6 +720,9 @@ import {
   StringFilter,
   Threat,
   ThreatIntelIndicator,
+  UnprocessedSecurityControl,
+  UnprocessedStandardsControlAssociation,
+  UnprocessedStandardsControlAssociationUpdate,
   VolumeMount,
   Vulnerability,
   VulnerabilityVendor,
@@ -712,11 +737,15 @@ import {
   Insight,
   InsightResults,
   InsightResultValue,
+  IntegrationType,
   Invitation,
   Member,
+  Product,
+  SecurityControlDefinition,
   SortCriterion,
   Standard,
   StandardsControl,
+  StandardsControlAssociationSummary,
   StandardsManagedBy,
 } from "../models/models_2";
 import { SecurityHubServiceException as __BaseException } from "../models/SecurityHubServiceException";
@@ -829,6 +858,62 @@ export const serializeAws_restJson1BatchEnableStandardsCommand = async (
   });
 };
 
+export const serializeAws_restJson1BatchGetSecurityControlsCommand = async (
+  input: BatchGetSecurityControlsCommandInput,
+  context: __SerdeContext
+): Promise<__HttpRequest> => {
+  const { hostname, protocol = "https", port, path: basePath } = await context.endpoint();
+  const headers: any = {
+    "content-type": "application/json",
+  };
+  const resolvedPath =
+    `${basePath?.endsWith("/") ? basePath.slice(0, -1) : basePath || ""}` + "/securityControls/batchGet";
+  let body: any;
+  body = JSON.stringify({
+    ...(input.SecurityControlIds != null && {
+      SecurityControlIds: serializeAws_restJson1StringList(input.SecurityControlIds, context),
+    }),
+  });
+  return new __HttpRequest({
+    protocol,
+    hostname,
+    port,
+    method: "POST",
+    headers,
+    path: resolvedPath,
+    body,
+  });
+};
+
+export const serializeAws_restJson1BatchGetStandardsControlAssociationsCommand = async (
+  input: BatchGetStandardsControlAssociationsCommandInput,
+  context: __SerdeContext
+): Promise<__HttpRequest> => {
+  const { hostname, protocol = "https", port, path: basePath } = await context.endpoint();
+  const headers: any = {
+    "content-type": "application/json",
+  };
+  const resolvedPath = `${basePath?.endsWith("/") ? basePath.slice(0, -1) : basePath || ""}` + "/associations/batchGet";
+  let body: any;
+  body = JSON.stringify({
+    ...(input.StandardsControlAssociationIds != null && {
+      StandardsControlAssociationIds: serializeAws_restJson1StandardsControlAssociationIds(
+        input.StandardsControlAssociationIds,
+        context
+      ),
+    }),
+  });
+  return new __HttpRequest({
+    protocol,
+    hostname,
+    port,
+    method: "POST",
+    headers,
+    path: resolvedPath,
+    body,
+  });
+};
+
 export const serializeAws_restJson1BatchImportFindingsCommand = async (
   input: BatchImportFindingsCommandInput,
   context: __SerdeContext
@@ -894,6 +979,35 @@ export const serializeAws_restJson1BatchUpdateFindingsCommand = async (
   });
 };
 
+export const serializeAws_restJson1BatchUpdateStandardsControlAssociationsCommand = async (
+  input: BatchUpdateStandardsControlAssociationsCommandInput,
+  context: __SerdeContext
+): Promise<__HttpRequest> => {
+  const { hostname, protocol = "https", port, path: basePath } = await context.endpoint();
+  const headers: any = {
+    "content-type": "application/json",
+  };
+  const resolvedPath = `${basePath?.endsWith("/") ? basePath.slice(0, -1) : basePath || ""}` + "/associations";
+  let body: any;
+  body = JSON.stringify({
+    ...(input.StandardsControlAssociationUpdates != null && {
+      StandardsControlAssociationUpdates: serializeAws_restJson1StandardsControlAssociationUpdates(
+        input.StandardsControlAssociationUpdates,
+        context
+      ),
+    }),
+  });
+  return new __HttpRequest({
+    protocol,
+    hostname,
+    port,
+    method: "PATCH",
+    headers,
+    path: resolvedPath,
+    body,
+  });
+};
+
 export const serializeAws_restJson1CreateActionTargetCommand = async (
   input: CreateActionTargetCommandInput,
   context: __SerdeContext
@@ -1509,6 +1623,7 @@ export const serializeAws_restJson1EnableSecurityHubCommand = async (
   const resolvedPath = `${basePath?.endsWith("/") ? basePath.slice(0, -1) : basePath || ""}` + "/accounts";
   let body: any;
   body = JSON.stringify({
+    ...(input.ControlFindingGenerator != null && { ControlFindingGenerator: input.ControlFindingGenerator }),
     ...(input.EnableDefaultStandards != null && { EnableDefaultStandards: input.EnableDefaultStandards }),
     ...(input.Tags != null && { Tags: serializeAws_restJson1TagMap(input.Tags, context) }),
   });
@@ -1895,6 +2010,57 @@ export const serializeAws_restJson1ListOrganizationAdminAccountsCommand = async
   });
 };
 
+export const serializeAws_restJson1ListSecurityControlDefinitionsCommand = async (
+  input: ListSecurityControlDefinitionsCommandInput,
+  context: __SerdeContext
+): Promise<__HttpRequest> => {
+  const { hostname, protocol = "https", port, path: basePath } = await context.endpoint();
+  const headers: any = {};
+  const resolvedPath =
+    `${basePath?.endsWith("/") ? basePath.slice(0, -1) : basePath || ""}` + "/securityControls/definitions";
+  const query: any = map({
+    StandardsArn: [, input.StandardsArn!],
+    NextToken: [, input.NextToken!],
+    MaxResults: [() => input.MaxResults !== void 0, () => input.MaxResults!.toString()],
+  });
+  let body: any;
+  return new __HttpRequest({
+    protocol,
+    hostname,
+    port,
+    method: "GET",
+    headers,
+    path: resolvedPath,
+    query,
+    body,
+  });
+};
+
+export const serializeAws_restJson1ListStandardsControlAssociationsCommand = async (
+  input: ListStandardsControlAssociationsCommandInput,
+  context: __SerdeContext
+): Promise<__HttpRequest> => {
+  const { hostname, protocol = "https", port, path: basePath } = await context.endpoint();
+  const headers: any = {};
+  const resolvedPath = `${basePath?.endsWith("/") ? basePath.slice(0, -1) : basePath || ""}` + "/associations";
+  const query: any = map({
+    SecurityControlId: [, __expectNonNull(input.SecurityControlId!, `SecurityControlId`)],
+    NextToken: [, input.NextToken!],
+    MaxResults: [() => input.MaxResults !== void 0, () => input.MaxResults!.toString()],
+  });
+  let body: any;
+  return new __HttpRequest({
+    protocol,
+    hostname,
+    port,
+    method: "GET",
+    headers,
+    path: resolvedPath,
+    query,
+    body,
+  });
+};
+
 export const serializeAws_restJson1ListTagsForResourceCommand = async (
   input: ListTagsForResourceCommandInput,
   context: __SerdeContext
@@ -2119,6 +2285,7 @@ export const serializeAws_restJson1UpdateSecurityHubConfigurationCommand = async
   let body: any;
   body = JSON.stringify({
     ...(input.AutoEnableControls != null && { AutoEnableControls: input.AutoEnableControls }),
+    ...(input.ControlFindingGenerator != null && { ControlFindingGenerator: input.ControlFindingGenerator }),
   });
   return new __HttpRequest({
     protocol,
@@ -2371,6 +2538,118 @@ const deserializeAws_restJson1BatchEnableStandardsCommandError = async (
   }
 };
 
+export const deserializeAws_restJson1BatchGetSecurityControlsCommand = async (
+  output: __HttpResponse,
+  context: __SerdeContext
+): Promise<BatchGetSecurityControlsCommandOutput> => {
+  if (output.statusCode !== 200 && output.statusCode >= 300) {
+    return deserializeAws_restJson1BatchGetSecurityControlsCommandError(output, context);
+  }
+  const contents: any = map({
+    $metadata: deserializeMetadata(output),
+  });
+  const data: Record<string, any> = __expectNonNull(__expectObject(await parseBody(output.body, context)), "body");
+  if (data.SecurityControls != null) {
+    contents.SecurityControls = deserializeAws_restJson1SecurityControls(data.SecurityControls, context);
+  }
+  if (data.UnprocessedIds != null) {
+    contents.UnprocessedIds = deserializeAws_restJson1UnprocessedSecurityControls(data.UnprocessedIds, context);
+  }
+  return contents;
+};
+
+const deserializeAws_restJson1BatchGetSecurityControlsCommandError = async (
+  output: __HttpResponse,
+  context: __SerdeContext
+): Promise<BatchGetSecurityControlsCommandOutput> => {
+  const parsedOutput: any = {
+    ...output,
+    body: await parseErrorBody(output.body, context),
+  };
+  const errorCode = loadRestJsonErrorCode(output, parsedOutput.body);
+  switch (errorCode) {
+    case "InternalException":
+    case "com.amazonaws.securityhub#InternalException":
+      throw await deserializeAws_restJson1InternalExceptionResponse(parsedOutput, context);
+    case "InvalidAccessException":
+    case "com.amazonaws.securityhub#InvalidAccessException":
+      throw await deserializeAws_restJson1InvalidAccessExceptionResponse(parsedOutput, context);
+    case "InvalidInputException":
+    case "com.amazonaws.securityhub#InvalidInputException":
+      throw await deserializeAws_restJson1InvalidInputExceptionResponse(parsedOutput, context);
+    case "LimitExceededException":
+    case "com.amazonaws.securityhub#LimitExceededException":
+      throw await deserializeAws_restJson1LimitExceededExceptionResponse(parsedOutput, context);
+    default:
+      const parsedBody = parsedOutput.body;
+      throwDefaultError({
+        output,
+        parsedBody,
+        exceptionCtor: __BaseException,
+        errorCode,
+      });
+  }
+};
+
+export const deserializeAws_restJson1BatchGetStandardsControlAssociationsCommand = async (
+  output: __HttpResponse,
+  context: __SerdeContext
+): Promise<BatchGetStandardsControlAssociationsCommandOutput> => {
+  if (output.statusCode !== 200 && output.statusCode >= 300) {
+    return deserializeAws_restJson1BatchGetStandardsControlAssociationsCommandError(output, context);
+  }
+  const contents: any = map({
+    $metadata: deserializeMetadata(output),
+  });
+  const data: Record<string, any> = __expectNonNull(__expectObject(await parseBody(output.body, context)), "body");
+  if (data.StandardsControlAssociationDetails != null) {
+    contents.StandardsControlAssociationDetails = deserializeAws_restJson1StandardsControlAssociationDetails(
+      data.StandardsControlAssociationDetails,
+      context
+    );
+  }
+  if (data.UnprocessedAssociations != null) {
+    contents.UnprocessedAssociations = deserializeAws_restJson1UnprocessedStandardsControlAssociations(
+      data.UnprocessedAssociations,
+      context
+    );
+  }
+  return contents;
+};
+
+const deserializeAws_restJson1BatchGetStandardsControlAssociationsCommandError = async (
+  output: __HttpResponse,
+  context: __SerdeContext
+): Promise<BatchGetStandardsControlAssociationsCommandOutput> => {
+  const parsedOutput: any = {
+    ...output,
+    body: await parseErrorBody(output.body, context),
+  };
+  const errorCode = loadRestJsonErrorCode(output, parsedOutput.body);
+  switch (errorCode) {
+    case "InternalException":
+    case "com.amazonaws.securityhub#InternalException":
+      throw await deserializeAws_restJson1InternalExceptionResponse(parsedOutput, context);
+    case "InvalidAccessException":
+    case "com.amazonaws.securityhub#InvalidAccessException":
+      throw await deserializeAws_restJson1InvalidAccessExceptionResponse(parsedOutput, context);
+    case "InvalidInputException":
+    case "com.amazonaws.securityhub#InvalidInputException":
+      throw await deserializeAws_restJson1InvalidInputExceptionResponse(parsedOutput, context);
+    case "LimitExceededException":
+    case "com.amazonaws.securityhub#LimitExceededException":
+      throw await deserializeAws_restJson1LimitExceededExceptionResponse(parsedOutput, context);
+    default:
+      const parsedBody = parsedOutput.body;
+      throwDefaultError({
+        output,
+        parsedBody,
+        exceptionCtor: __BaseException,
+        errorCode,
+      });
+  }
+};
+
 export const deserializeAws_restJson1BatchImportFindingsCommand = async (
   output: __HttpResponse,
   context: __SerdeContext
@@ -2486,6 +2765,59 @@ const deserializeAws_restJson1BatchUpdateFindingsCommandError = async (
   }
 };
 
+export const deserializeAws_restJson1BatchUpdateStandardsControlAssociationsCommand = async (
+  output: __HttpResponse,
+  context: __SerdeContext
+): Promise<BatchUpdateStandardsControlAssociationsCommandOutput> => {
+  if (output.statusCode !== 200 && output.statusCode >= 300) {
+    return deserializeAws_restJson1BatchUpdateStandardsControlAssociationsCommandError(output, context);
+  }
+  const contents: any = map({
+    $metadata: deserializeMetadata(output),
+  });
+  const data: Record<string, any> = __expectNonNull(__expectObject(await parseBody(output.body, context)), "body");
+  if (data.UnprocessedAssociationUpdates != null) {
+    contents.UnprocessedAssociationUpdates = deserializeAws_restJson1UnprocessedStandardsControlAssociationUpdates(
+      data.UnprocessedAssociationUpdates,
+      context
+    );
+  }
+  return contents;
+};
+
+const deserializeAws_restJson1BatchUpdateStandardsControlAssociationsCommandError = async (
+  output: __HttpResponse,
+  context: __SerdeContext
+): Promise<BatchUpdateStandardsControlAssociationsCommandOutput> => {
+  const parsedOutput: any = {
+    ...output,
+    body: await parseErrorBody(output.body, context),
+  };
+  const errorCode = loadRestJsonErrorCode(output, parsedOutput.body);
+  switch (errorCode) {
+    case "InternalException":
+    case "com.amazonaws.securityhub#InternalException":
+      throw await deserializeAws_restJson1InternalExceptionResponse(parsedOutput, context);
+    case "InvalidAccessException":
+    case "com.amazonaws.securityhub#InvalidAccessException":
+      throw await deserializeAws_restJson1InvalidAccessExceptionResponse(parsedOutput, context);
+    case "InvalidInputException":
+    case "com.amazonaws.securityhub#InvalidInputException":
+      throw await deserializeAws_restJson1InvalidInputExceptionResponse(parsedOutput, context);
+    case "LimitExceededException":
+    case "com.amazonaws.securityhub#LimitExceededException":
+      throw await deserializeAws_restJson1LimitExceededExceptionResponse(parsedOutput, context);
+    default:
+      const parsedBody = parsedOutput.body;
+      throwDefaultError({
+        output,
+        parsedBody,
+        exceptionCtor: __BaseException,
+        errorCode,
+      });
+  }
+};
+
 export const deserializeAws_restJson1CreateActionTargetCommand = async (
   output: __HttpResponse,
   context: __SerdeContext
@@ -3086,6 +3418,9 @@ export const deserializeAws_restJson1DescribeHubCommand = async (
   if (data.AutoEnableControls != null) {
     contents.AutoEnableControls = __expectBoolean(data.AutoEnableControls);
   }
+  if (data.ControlFindingGenerator != null) {
+    contents.ControlFindingGenerator = __expectString(data.ControlFindingGenerator);
+  }
   if (data.HubArn != null) {
     contents.HubArn = __expectString(data.HubArn);
   }
@@ -4411,16 +4746,122 @@ export const deserializeAws_restJson1ListFindingAggregatorsCommand = async (
 const deserializeAws_restJson1ListFindingAggregatorsCommandError = async (
   output: __HttpResponse,
   context: __SerdeContext
-): Promise<ListFindingAggregatorsCommandOutput> => {
+): Promise<ListFindingAggregatorsCommandOutput> => {
+  const parsedOutput: any = {
+    ...output,
+    body: await parseErrorBody(output.body, context),
+  };
+  const errorCode = loadRestJsonErrorCode(output, parsedOutput.body);
+  switch (errorCode) {
+    case "AccessDeniedException":
+    case "com.amazonaws.securityhub#AccessDeniedException":
+      throw await deserializeAws_restJson1AccessDeniedExceptionResponse(parsedOutput, context);
+    case "InternalException":
+    case "com.amazonaws.securityhub#InternalException":
+      throw await deserializeAws_restJson1InternalExceptionResponse(parsedOutput, context);
+    case "InvalidAccessException":
+    case "com.amazonaws.securityhub#InvalidAccessException":
+      throw await deserializeAws_restJson1InvalidAccessExceptionResponse(parsedOutput, context);
+    case "InvalidInputException":
+    case "com.amazonaws.securityhub#InvalidInputException":
+      throw await deserializeAws_restJson1InvalidInputExceptionResponse(parsedOutput, context);
+    case "LimitExceededException":
+    case "com.amazonaws.securityhub#LimitExceededException":
+      throw await deserializeAws_restJson1LimitExceededExceptionResponse(parsedOutput, context);
+    default:
+      const parsedBody = parsedOutput.body;
+      throwDefaultError({
+        output,
+        parsedBody,
+        exceptionCtor: __BaseException,
+        errorCode,
+      });
+  }
+};
+
+export const deserializeAws_restJson1ListInvitationsCommand = async (
+  output: __HttpResponse,
+  context: __SerdeContext
+): Promise<ListInvitationsCommandOutput> => {
+  if (output.statusCode !== 200 && output.statusCode >= 300) {
+    return deserializeAws_restJson1ListInvitationsCommandError(output, context);
+  }
+  const contents: any = map({
+    $metadata: deserializeMetadata(output),
+  });
+  const data: Record<string, any> = __expectNonNull(__expectObject(await parseBody(output.body, context)), "body");
+  if (data.Invitations != null) {
+    contents.Invitations = deserializeAws_restJson1InvitationList(data.Invitations, context);
+  }
+  if (data.NextToken != null) {
+    contents.NextToken = __expectString(data.NextToken);
+  }
+  return contents;
+};
+
+const deserializeAws_restJson1ListInvitationsCommandError = async (
+  output: __HttpResponse,
+  context: __SerdeContext
+): Promise<ListInvitationsCommandOutput> => {
+  const parsedOutput: any = {
+    ...output,
+    body: await parseErrorBody(output.body, context),
+  };
+  const errorCode = loadRestJsonErrorCode(output, parsedOutput.body);
+  switch (errorCode) {
+    case "InternalException":
+    case "com.amazonaws.securityhub#InternalException":
+      throw await deserializeAws_restJson1InternalExceptionResponse(parsedOutput, context);
+    case "InvalidAccessException":
+    case "com.amazonaws.securityhub#InvalidAccessException":
+      throw await deserializeAws_restJson1InvalidAccessExceptionResponse(parsedOutput, context);
+    case "InvalidInputException":
+    case "com.amazonaws.securityhub#InvalidInputException":
+      throw await deserializeAws_restJson1InvalidInputExceptionResponse(parsedOutput, context);
+    case "LimitExceededException":
+    case "com.amazonaws.securityhub#LimitExceededException":
+      throw await deserializeAws_restJson1LimitExceededExceptionResponse(parsedOutput, context);
+    default:
+      const parsedBody = parsedOutput.body;
+      throwDefaultError({
+        output,
+        parsedBody,
+        exceptionCtor: __BaseException,
+        errorCode,
+      });
+  }
+};
+
+export const deserializeAws_restJson1ListMembersCommand = async (
+  output: __HttpResponse,
+  context: __SerdeContext
+): Promise<ListMembersCommandOutput> => {
+  if (output.statusCode !== 200 && output.statusCode >= 300) {
+    return deserializeAws_restJson1ListMembersCommandError(output, context);
+  }
+  const contents: any = map({
+    $metadata: deserializeMetadata(output),
+  });
+  const data: Record<string, any> = __expectNonNull(__expectObject(await parseBody(output.body, context)), "body");
+  if (data.Members != null) {
+    contents.Members = deserializeAws_restJson1MemberList(data.Members, context);
+  }
+  if (data.NextToken != null) {
+    contents.NextToken = __expectString(data.NextToken);
+  }
+  return contents;
+};
+
+const deserializeAws_restJson1ListMembersCommandError = async (
+  output: __HttpResponse,
+  context: __SerdeContext
+): Promise<ListMembersCommandOutput> => {
   const parsedOutput: any = {
     ...output,
     body: await parseErrorBody(output.body, context),
   };
   const errorCode = loadRestJsonErrorCode(output, parsedOutput.body);
   switch (errorCode) {
-    case "AccessDeniedException":
-    case "com.amazonaws.securityhub#AccessDeniedException":
-      throw await deserializeAws_restJson1AccessDeniedExceptionResponse(parsedOutput, context);
     case "InternalException":
     case "com.amazonaws.securityhub#InternalException":
       throw await deserializeAws_restJson1InternalExceptionResponse(parsedOutput, context);
@@ -4444,19 +4885,19 @@ const deserializeAws_restJson1ListFindingAggregatorsCommandError = async (
   }
 };
 
-export const deserializeAws_restJson1ListInvitationsCommand = async (
+export const deserializeAws_restJson1ListOrganizationAdminAccountsCommand = async (
   output: __HttpResponse,
   context: __SerdeContext
-): Promise<ListInvitationsCommandOutput> => {
+): Promise<ListOrganizationAdminAccountsCommandOutput> => {
   if (output.statusCode !== 200 && output.statusCode >= 300) {
-    return deserializeAws_restJson1ListInvitationsCommandError(output, context);
+    return deserializeAws_restJson1ListOrganizationAdminAccountsCommandError(output, context);
   }
   const contents: any = map({
     $metadata: deserializeMetadata(output),
   });
   const data: Record<string, any> = __expectNonNull(__expectObject(await parseBody(output.body, context)), "body");
-  if (data.Invitations != null) {
-    contents.Invitations = deserializeAws_restJson1InvitationList(data.Invitations, context);
+  if (data.AdminAccounts != null) {
+    contents.AdminAccounts = deserializeAws_restJson1AdminAccounts(data.AdminAccounts, context);
   }
   if (data.NextToken != null) {
     contents.NextToken = __expectString(data.NextToken);
@@ -4464,10 +4905,10 @@ export const deserializeAws_restJson1ListInvitationsCommand = async (
   return contents;
 };
 
-const deserializeAws_restJson1ListInvitationsCommandError = async (
+const deserializeAws_restJson1ListOrganizationAdminAccountsCommandError = async (
   output: __HttpResponse,
   context: __SerdeContext
-): Promise<ListInvitationsCommandOutput> => {
+): Promise<ListOrganizationAdminAccountsCommandOutput> => {
   const parsedOutput: any = {
     ...output,
     body: await parseErrorBody(output.body, context),
@@ -4497,30 +4938,33 @@ const deserializeAws_restJson1ListInvitationsCommandError = async (
   }
 };
 
-export const deserializeAws_restJson1ListMembersCommand = async (
+export const deserializeAws_restJson1ListSecurityControlDefinitionsCommand = async (
   output: __HttpResponse,
   context: __SerdeContext
-): Promise<ListMembersCommandOutput> => {
+): Promise<ListSecurityControlDefinitionsCommandOutput> => {
   if (output.statusCode !== 200 && output.statusCode >= 300) {
-    return deserializeAws_restJson1ListMembersCommandError(output, context);
+    return deserializeAws_restJson1ListSecurityControlDefinitionsCommandError(output, context);
   }
   const contents: any = map({
     $metadata: deserializeMetadata(output),
   });
   const data: Record<string, any> = __expectNonNull(__expectObject(await parseBody(output.body, context)), "body");
-  if (data.Members != null) {
-    contents.Members = deserializeAws_restJson1MemberList(data.Members, context);
-  }
   if (data.NextToken != null) {
     contents.NextToken = __expectString(data.NextToken);
   }
+  if (data.SecurityControlDefinitions != null) {
+    contents.SecurityControlDefinitions = deserializeAws_restJson1SecurityControlDefinitions(
+      data.SecurityControlDefinitions,
+      context
+    );
+  }
   return contents;
 };
 
-const deserializeAws_restJson1ListMembersCommandError = async (
+const deserializeAws_restJson1ListSecurityControlDefinitionsCommandError = async (
   output: __HttpResponse,
   context: __SerdeContext
-): Promise<ListMembersCommandOutput> => {
+): Promise<ListSecurityControlDefinitionsCommandOutput> => {
   const parsedOutput: any = {
     ...output,
     body: await parseErrorBody(output.body, context),
@@ -4550,30 +4994,33 @@ const deserializeAws_restJson1ListMembersCommandError = async (
   }
 };
 
-export const deserializeAws_restJson1ListOrganizationAdminAccountsCommand = async (
+export const deserializeAws_restJson1ListStandardsControlAssociationsCommand = async (
   output: __HttpResponse,
   context: __SerdeContext
-): Promise<ListOrganizationAdminAccountsCommandOutput> => {
+): Promise<ListStandardsControlAssociationsCommandOutput> => {
   if (output.statusCode !== 200 && output.statusCode >= 300) {
-    return deserializeAws_restJson1ListOrganizationAdminAccountsCommandError(output, context);
+    return deserializeAws_restJson1ListStandardsControlAssociationsCommandError(output, context);
   }
   const contents: any = map({
     $metadata: deserializeMetadata(output),
   });
   const data: Record<string, any> = __expectNonNull(__expectObject(await parseBody(output.body, context)), "body");
-  if (data.AdminAccounts != null) {
-    contents.AdminAccounts = deserializeAws_restJson1AdminAccounts(data.AdminAccounts, context);
-  }
   if (data.NextToken != null) {
     contents.NextToken = __expectString(data.NextToken);
   }
+  if (data.StandardsControlAssociationSummaries != null) {
+    contents.StandardsControlAssociationSummaries = deserializeAws_restJson1StandardsControlAssociationSummaries(
+      data.StandardsControlAssociationSummaries,
+      context
+    );
+  }
   return contents;
 };
 
-const deserializeAws_restJson1ListOrganizationAdminAccountsCommandError = async (
+const deserializeAws_restJson1ListStandardsControlAssociationsCommandError = async (
   output: __HttpResponse,
   context: __SerdeContext
-): Promise<ListOrganizationAdminAccountsCommandOutput> => {
+): Promise<ListStandardsControlAssociationsCommandOutput> => {
   const parsedOutput: any = {
     ...output,
     body: await parseErrorBody(output.body, context),
@@ -15563,6 +16010,50 @@ const serializeAws_restJson1SortCriterion = (input: SortCriterion, context: __Se
   };
 };
 
+const serializeAws_restJson1StandardsControlAssociationId = (
+  input: StandardsControlAssociationId,
+  context: __SerdeContext
+): any => {
+  return {
+    ...(input.SecurityControlId != null && { SecurityControlId: input.SecurityControlId }),
+    ...(input.StandardsArn != null && { StandardsArn: input.StandardsArn }),
+  };
+};
+
+const serializeAws_restJson1StandardsControlAssociationIds = (
+  input: StandardsControlAssociationId[],
+  context: __SerdeContext
+): any => {
+  return input
+    .filter((e: any) => e != null)
+    .map((entry) => {
+      return serializeAws_restJson1StandardsControlAssociationId(entry, context);
+    });
+};
+
+const serializeAws_restJson1StandardsControlAssociationUpdate = (
+  input: StandardsControlAssociationUpdate,
+  context: __SerdeContext
+): any => {
+  return {
+    ...(input.AssociationStatus != null && { AssociationStatus: input.AssociationStatus }),
+    ...(input.SecurityControlId != null && { SecurityControlId: input.SecurityControlId }),
+    ...(input.StandardsArn != null && { StandardsArn: input.StandardsArn }),
+    ...(input.UpdatedReason != null && { UpdatedReason: input.UpdatedReason }),
+  };
+};
+
+const serializeAws_restJson1StandardsControlAssociationUpdates = (
+  input: StandardsControlAssociationUpdate[],
+  context: __SerdeContext
+): any => {
+  return input
+    .filter((e: any) => e != null)
+    .map((entry) => {
+      return serializeAws_restJson1StandardsControlAssociationUpdate(entry, context);
+    });
+};
+
 const serializeAws_restJson1StandardsInputParameterMap = (
   input: Record<string, string>,
   context: __SerdeContext
@@ -27186,6 +27677,59 @@ const deserializeAws_restJson1RuleGroupVariablesPortSetsDetails = (
   } as any;
 };
 
+const deserializeAws_restJson1SecurityControl = (output: any, context: __SerdeContext): SecurityControl => {
+  return {
+    Description: __expectString(output.Description),
+    RemediationUrl: __expectString(output.RemediationUrl),
+    SecurityControlArn: __expectString(output.SecurityControlArn),
+    SecurityControlId: __expectString(output.SecurityControlId),
+    SecurityControlStatus: __expectString(output.SecurityControlStatus),
+    SeverityRating: __expectString(output.SeverityRating),
+    Title: __expectString(output.Title),
+  } as any;
+};
+
+const deserializeAws_restJson1SecurityControlDefinition = (
+  output: any,
+  context: __SerdeContext
+): SecurityControlDefinition => {
+  return {
+    CurrentRegionAvailability: __expectString(output.CurrentRegionAvailability),
+    Description: __expectString(output.Description),
+    RemediationUrl: __expectString(output.RemediationUrl),
+    SecurityControlId: __expectString(output.SecurityControlId),
+    SeverityRating: __expectString(output.SeverityRating),
+    Title: __expectString(output.Title),
+  } as any;
+};
+
+const deserializeAws_restJson1SecurityControlDefinitions = (
+  output: any,
+  context: __SerdeContext
+): SecurityControlDefinition[] => {
+  const retVal = (output || [])
+    .filter((e: any) => e != null)
+    .map((entry: any) => {
+      if (entry === null) {
+        return null as any;
+      }
+      return deserializeAws_restJson1SecurityControlDefinition(entry, context);
+    });
+  return retVal;
+};
+
+const deserializeAws_restJson1SecurityControls = (output: any, context: __SerdeContext): SecurityControl[] => {
+  const retVal = (output || [])
+    .filter((e: any) => e != null)
+    .map((entry: any) => {
+      if (entry === null) {
+        return null as any;
+      }
+      return deserializeAws_restJson1SecurityControl(entry, context);
+    });
+  return retVal;
+};
+
 const deserializeAws_restJson1SecurityGroups = (output: any, context: __SerdeContext): string[] => {
   const retVal = (output || [])
     .filter((e: any) => e != null)
@@ -27334,6 +27878,116 @@ const deserializeAws_restJson1StandardsControl = (output: any, context: __SerdeC
   } as any;
 };
 
+const deserializeAws_restJson1StandardsControlArnList = (output: any, context: __SerdeContext): string[] => {
+  const retVal = (output || [])
+    .filter((e: any) => e != null)
+    .map((entry: any) => {
+      if (entry === null) {
+        return null as any;
+      }
+      return __expectString(entry) as any;
+    });
+  return retVal;
+};
+
+const deserializeAws_restJson1StandardsControlAssociationDetail = (
+  output: any,
+  context: __SerdeContext
+): StandardsControlAssociationDetail => {
+  return {
+    AssociationStatus: __expectString(output.AssociationStatus),
+    RelatedRequirements:
+      output.RelatedRequirements != null
+        ? deserializeAws_restJson1RelatedRequirementsList(output.RelatedRequirements, context)
+        : undefined,
+    SecurityControlArn: __expectString(output.SecurityControlArn),
+    SecurityControlId: __expectString(output.SecurityControlId),
+    StandardsArn: __expectString(output.StandardsArn),
+    StandardsControlArns:
+      output.StandardsControlArns != null
+        ? deserializeAws_restJson1StandardsControlArnList(output.StandardsControlArns, context)
+        : undefined,
+    StandardsControlDescription: __expectString(output.StandardsControlDescription),
+    StandardsControlTitle: __expectString(output.StandardsControlTitle),
+    UpdatedAt:
+      output.UpdatedAt != null ? __expectNonNull(__parseRfc3339DateTimeWithOffset(output.UpdatedAt)) : undefined,
+    UpdatedReason: __expectString(output.UpdatedReason),
+  } as any;
+};
+
+const deserializeAws_restJson1StandardsControlAssociationDetails = (
+  output: any,
+  context: __SerdeContext
+): StandardsControlAssociationDetail[] => {
+  const retVal = (output || [])
+    .filter((e: any) => e != null)
+    .map((entry: any) => {
+      if (entry === null) {
+        return null as any;
+      }
+      return deserializeAws_restJson1StandardsControlAssociationDetail(entry, context);
+    });
+  return retVal;
+};
+
+const deserializeAws_restJson1StandardsControlAssociationId = (
+  output: any,
+  context: __SerdeContext
+): StandardsControlAssociationId => {
+  return {
+    SecurityControlId: __expectString(output.SecurityControlId),
+    StandardsArn: __expectString(output.StandardsArn),
+  } as any;
+};
+
+const deserializeAws_restJson1StandardsControlAssociationSummaries = (
+  output: any,
+  context: __SerdeContext
+): StandardsControlAssociationSummary[] => {
+  const retVal = (output || [])
+    .filter((e: any) => e != null)
+    .map((entry: any) => {
+      if (entry === null) {
+        return null as any;
+      }
+      return deserializeAws_restJson1StandardsControlAssociationSummary(entry, context);
+    });
+  return retVal;
+};
+
+const deserializeAws_restJson1StandardsControlAssociationSummary = (
+  output: any,
+  context: __SerdeContext
+): StandardsControlAssociationSummary => {
+  return {
+    AssociationStatus: __expectString(output.AssociationStatus),
+    RelatedRequirements:
+      output.RelatedRequirements != null
+        ? deserializeAws_restJson1RelatedRequirementsList(output.RelatedRequirements, context)
+        : undefined,
+    SecurityControlArn: __expectString(output.SecurityControlArn),
+    SecurityControlId: __expectString(output.SecurityControlId),
+    StandardsArn: __expectString(output.StandardsArn),
+    StandardsControlDescription: __expectString(output.StandardsControlDescription),
+    StandardsControlTitle: __expectString(output.StandardsControlTitle),
+    UpdatedAt:
+      output.UpdatedAt != null ? __expectNonNull(__parseRfc3339DateTimeWithOffset(output.UpdatedAt)) : undefined,
+    UpdatedReason: __expectString(output.UpdatedReason),
+  } as any;
+};
+
+const deserializeAws_restJson1StandardsControlAssociationUpdate = (
+  output: any,
+  context: __SerdeContext
+): StandardsControlAssociationUpdate => {
+  return {
+    AssociationStatus: __expectString(output.AssociationStatus),
+    SecurityControlId: __expectString(output.SecurityControlId),
+    StandardsArn: __expectString(output.StandardsArn),
+    UpdatedReason: __expectString(output.UpdatedReason),
+  } as any;
+};
+
 const deserializeAws_restJson1StandardsControls = (output: any, context: __SerdeContext): StandardsControl[] => {
   const retVal = (output || [])
     .filter((e: any) => e != null)
@@ -27570,6 +28224,90 @@ const deserializeAws_restJson1TypeList = (output: any, context: __SerdeContext):
   return retVal;
 };
 
+const deserializeAws_restJson1UnprocessedSecurityControl = (
+  output: any,
+  context: __SerdeContext
+): UnprocessedSecurityControl => {
+  return {
+    ErrorCode: __expectString(output.ErrorCode),
+    ErrorReason: __expectString(output.ErrorReason),
+    SecurityControlId: __expectString(output.SecurityControlId),
+  } as any;
+};
+
+const deserializeAws_restJson1UnprocessedSecurityControls = (
+  output: any,
+  context: __SerdeContext
+): UnprocessedSecurityControl[] => {
+  const retVal = (output || [])
+    .filter((e: any) => e != null)
+    .map((entry: any) => {
+      if (entry === null) {
+        return null as any;
+      }
+      return deserializeAws_restJson1UnprocessedSecurityControl(entry, context);
+    });
+  return retVal;
+};
+
+const deserializeAws_restJson1UnprocessedStandardsControlAssociation = (
+  output: any,
+  context: __SerdeContext
+): UnprocessedStandardsControlAssociation => {
+  return {
+    ErrorCode: __expectString(output.ErrorCode),
+    ErrorReason: __expectString(output.ErrorReason),
+    StandardsControlAssociationId:
+      output.StandardsControlAssociationId != null
+        ? deserializeAws_restJson1StandardsControlAssociationId(output.StandardsControlAssociationId, context)
+        : undefined,
+  } as any;
+};
+
+const deserializeAws_restJson1UnprocessedStandardsControlAssociations = (
+  output: any,
+  context: __SerdeContext
+): UnprocessedStandardsControlAssociation[] => {
+  const retVal = (output || [])
+    .filter((e: any) => e != null)
+    .map((entry: any) => {
+      if (entry === null) {
+        return null as any;
+      }
+      return deserializeAws_restJson1UnprocessedStandardsControlAssociation(entry, context);
+    });
+  return retVal;
+};
+
+const deserializeAws_restJson1UnprocessedStandardsControlAssociationUpdate = (
+  output: any,
+  context: __SerdeContext
+): UnprocessedStandardsControlAssociationUpdate => {
+  return {
+    ErrorCode: __expectString(output.ErrorCode),
+    ErrorReason: __expectString(output.ErrorReason),
+    StandardsControlAssociationUpdate:
+      output.StandardsControlAssociationUpdate != null
+        ? deserializeAws_restJson1StandardsControlAssociationUpdate(output.StandardsControlAssociationUpdate, context)
+        : undefined,
+  } as any;
+};
+
+const deserializeAws_restJson1UnprocessedStandardsControlAssociationUpdates = (
+  output: any,
+  context: __SerdeContext
+): UnprocessedStandardsControlAssociationUpdate[] => {
+  const retVal = (output || [])
+    .filter((e: any) => e != null)
+    .map((entry: any) => {
+      if (entry === null) {
+        return null as any;
+      }
+      return deserializeAws_restJson1UnprocessedStandardsControlAssociationUpdate(entry, context);
+    });
+  return retVal;
+};
+
 const deserializeAws_restJson1VolumeMount = (output: any, context: __SerdeContext): VolumeMount => {
   return {
     MountPath: __expectString(output.MountPath),
diff --git a/codegen/sdk-codegen/aws-models/securityhub.json b/codegen/sdk-codegen/aws-models/securityhub.json
index 4ce73f42465a..e3e68d2de3f8 100644
--- a/codegen/sdk-codegen/aws-models/securityhub.json
+++ b/codegen/sdk-codegen/aws-models/securityhub.json
@@ -482,6 +482,23 @@
         "target": "com.amazonaws.securityhub#AssociatedStandard"
       }
     },
+    "com.amazonaws.securityhub#AssociationStatus": {
+      "type": "enum",
+      "members": {
+        "ENABLED": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ENABLED"
+          }
+        },
+        "DISABLED": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "DISABLED"
+          }
+        }
+      }
+    },
     "com.amazonaws.securityhub#AutoEnableStandards": {
       "type": "enum",
       "members": {
@@ -1879,7 +1896,7 @@
         "SnsTopicArn": {
           "target": "com.amazonaws.securityhub#NonEmptyString",
           "traits": {
-            "smithy.api#documentation": "<p>An ARN that uniquely identifies the Amazon SNS topic for a backup vault’s events.\n      </p>"
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) that uniquely identifies the Amazon SNS topic for\n         a backup vault's events. </p>"
           }
         }
       },
@@ -5098,7 +5115,7 @@
           "target": "com.amazonaws.securityhub#Integer",
           "traits": {
             "smithy.api#default": 0,
-            "smithy.api#documentation": "<p>\n         The price protection threshold for On-Demand Instances. This is the maximum you’ll pay for an On-Demand Instance, expressed as a percentage above the least expensive current generation M, C, or R instance type with your specified attributes. When Amazon EC2 selects instance types with your attributes, it excludes instance types priced above your threshold.</p>\n         <p>The parameter accepts an integer, which Amazon EC2 interprets as a percentage.</p>\n         <p>A high value, such as <code>999999</code>, turns off price protection.</p>"
+            "smithy.api#documentation": "<p> The price protection threshold for On-Demand Instances. This is the maximum you'll pay\n         for an On-Demand Instance, expressed as a percentage above the least expensive current\n         generation M, C, or R instance type with your specified attributes. When Amazon EC2 selects\n         instance types with your attributes, it excludes instance types priced above your\n         threshold.</p>\n         <p>The parameter accepts an integer, which Amazon EC2 interprets as a percentage.</p>\n         <p>A high value, such as <code>999999</code>, turns off price protection.</p>"
           }
         },
         "RequireHibernateSupport": {
@@ -5112,7 +5129,7 @@
           "target": "com.amazonaws.securityhub#Integer",
           "traits": {
             "smithy.api#default": 0,
-            "smithy.api#documentation": "<p>\n         The price protection threshold for Spot Instances. This is the maximum you’ll pay for a Spot Instance, expressed as a \n         percentage above the least expensive current generation M, C, or R instance type with your specified attributes. When \n         Amazon EC2 selects instance types with your attributes, it excludes instance types priced above your threshold.\n      </p>\n         <p>The parameter accepts an integer, which Amazon EC2 interprets as a percentage.</p>\n         <p>A high value, such as <code>999999</code>, turns off price protection.</p>"
+            "smithy.api#documentation": "<p> The price protection threshold for Spot Instances. This is the maximum you'll pay for a\n         Spot Instance, expressed as a percentage above the least expensive current generation M, C,\n         or R instance type with your specified attributes. When Amazon EC2 selects instance\n         types with your attributes, it excludes instance types priced above your threshold. </p>\n         <p>The parameter accepts an integer, which Amazon EC2 interprets as a percentage.</p>\n         <p>A high value, such as <code>999999</code>, turns off price protection.</p>"
           }
         },
         "TotalLocalStorageGB": {
@@ -5282,7 +5299,7 @@
         "HttpEndpoint": {
           "target": "com.amazonaws.securityhub#NonEmptyString",
           "traits": {
-            "smithy.api#documentation": "<p>\n         Enables or disables the HTTP metadata endpoint on your instances. If the parameter is not specified, the default state is enabled, and you won’t be able to access your instance metadata.\n      </p>"
+            "smithy.api#documentation": "<p> Enables or disables the HTTP metadata endpoint on your instances. If the parameter is\n         not specified, the default state is enabled, and you won't be able to access your instance\n         metadata. </p>"
           }
         },
         "HttpProtocolIpv6": {
@@ -13979,7 +13996,7 @@
           "target": "com.amazonaws.securityhub#Integer",
           "traits": {
             "smithy.api#default": 0,
-            "smithy.api#documentation": "<p>The number of days that manual snapshots are retained in the destination region after\n         they are copied from a source region.</p>\n         <p>If the value is <code>-1</code>,\n         then the manual snapshot is retained indefinitely.</p>\n         <p>Valid values: Either <code>-1</code>\n         or an integer between 1 and 3,653</p>"
+            "smithy.api#documentation": "<p>The number of days that manual snapshots are retained in the destination Region after\n         they are copied from a source Region.</p>\n         <p>If the value is <code>-1</code>,\n         then the manual snapshot is retained indefinitely.</p>\n         <p>Valid values: Either <code>-1</code>\n         or an integer between 1 and 3,653</p>"
           }
         },
         "RetentionPeriod": {
@@ -13997,7 +14014,7 @@
         }
       },
       "traits": {
-        "smithy.api#documentation": "<p>Information about a cross-Region snapshot copy.</p>"
+        "smithy.api#documentation": "<p>You can configure Amazon Redshift to copy snapshots for a cluster to another Amazon Web Services Region. This parameter \n         provides information about a cross-Region snapshot copy.</p>"
       }
     },
     "com.amazonaws.securityhub#AwsRedshiftClusterDeferredMaintenanceWindow": {
@@ -18042,6 +18059,140 @@
         "smithy.api#output": {}
       }
     },
+    "com.amazonaws.securityhub#BatchGetSecurityControls": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.securityhub#BatchGetSecurityControlsRequest"
+      },
+      "output": {
+        "target": "com.amazonaws.securityhub#BatchGetSecurityControlsResponse"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.securityhub#InternalException"
+        },
+        {
+          "target": "com.amazonaws.securityhub#InvalidAccessException"
+        },
+        {
+          "target": "com.amazonaws.securityhub#InvalidInputException"
+        },
+        {
+          "target": "com.amazonaws.securityhub#LimitExceededException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>\n         Provides details about a batch of security controls for the current Amazon Web Services account and Amazon Web Services Region.\n      </p>",
+        "smithy.api#http": {
+          "method": "POST",
+          "uri": "/securityControls/batchGet",
+          "code": 200
+        }
+      }
+    },
+    "com.amazonaws.securityhub#BatchGetSecurityControlsRequest": {
+      "type": "structure",
+      "members": {
+        "SecurityControlIds": {
+          "target": "com.amazonaws.securityhub#StringList",
+          "traits": {
+            "smithy.api#documentation": "<p> A list of security controls (identified with <code>SecurityControlId</code>,\n            <code>SecurityControlArn</code>, or a mix of both parameters). The security control ID\n         or Amazon Resource Name (ARN) is the same across standards. </p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.securityhub#BatchGetSecurityControlsResponse": {
+      "type": "structure",
+      "members": {
+        "SecurityControls": {
+          "target": "com.amazonaws.securityhub#SecurityControls",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         An array that returns the identifier, Amazon Resource Name (ARN), and other details about a security control. \n         The same information is returned whether the request includes <code>SecurityControlId</code> or <code>SecurityControlArn</code>.\n      </p>",
+            "smithy.api#required": {}
+          }
+        },
+        "UnprocessedIds": {
+          "target": "com.amazonaws.securityhub#UnprocessedSecurityControls",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         A security control (identified with <code>SecurityControlId</code>, <code>SecurityControlArn</code>, or a mix of both parameters) for which \n         details cannot be returned.\n      </p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.securityhub#BatchGetStandardsControlAssociations": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.securityhub#BatchGetStandardsControlAssociationsRequest"
+      },
+      "output": {
+        "target": "com.amazonaws.securityhub#BatchGetStandardsControlAssociationsResponse"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.securityhub#InternalException"
+        },
+        {
+          "target": "com.amazonaws.securityhub#InvalidAccessException"
+        },
+        {
+          "target": "com.amazonaws.securityhub#InvalidInputException"
+        },
+        {
+          "target": "com.amazonaws.securityhub#LimitExceededException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>\n         For a batch of security controls and standards, identifies whether each control is currently enabled or disabled in a standard.\n      </p>",
+        "smithy.api#http": {
+          "method": "POST",
+          "uri": "/associations/batchGet",
+          "code": 200
+        }
+      }
+    },
+    "com.amazonaws.securityhub#BatchGetStandardsControlAssociationsRequest": {
+      "type": "structure",
+      "members": {
+        "StandardsControlAssociationIds": {
+          "target": "com.amazonaws.securityhub#StandardsControlAssociationIds",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         An array with one or more objects that includes a security control (identified with <code>SecurityControlId</code>, <code>SecurityControlArn</code>, or a mix of both parameters) and the Amazon Resource Name (ARN) of a standard. \n         This field is used to query the enablement status of a control in a specified standard. The security control ID or ARN is the same across standards.\n      </p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.securityhub#BatchGetStandardsControlAssociationsResponse": {
+      "type": "structure",
+      "members": {
+        "StandardsControlAssociationDetails": {
+          "target": "com.amazonaws.securityhub#StandardsControlAssociationDetails",
+          "traits": {
+            "smithy.api#documentation": "<p>Provides the enablement status of a security control in a specified standard and other details for the control in relation to \n         the specified standard.\n      </p>",
+            "smithy.api#required": {}
+          }
+        },
+        "UnprocessedAssociations": {
+          "target": "com.amazonaws.securityhub#UnprocessedStandardsControlAssociations",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         A security control (identified with <code>SecurityControlId</code>, <code>SecurityControlArn</code>, or a mix of both parameters) whose enablement \n         status in a specified standard cannot be returned.\n      </p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
     "com.amazonaws.securityhub#BatchImportFindings": {
       "type": "operation",
       "input": {
@@ -18286,6 +18437,66 @@
         "target": "com.amazonaws.securityhub#BatchUpdateFindingsUnprocessedFinding"
       }
     },
+    "com.amazonaws.securityhub#BatchUpdateStandardsControlAssociations": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.securityhub#BatchUpdateStandardsControlAssociationsRequest"
+      },
+      "output": {
+        "target": "com.amazonaws.securityhub#BatchUpdateStandardsControlAssociationsResponse"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.securityhub#InternalException"
+        },
+        {
+          "target": "com.amazonaws.securityhub#InvalidAccessException"
+        },
+        {
+          "target": "com.amazonaws.securityhub#InvalidInputException"
+        },
+        {
+          "target": "com.amazonaws.securityhub#LimitExceededException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>\n         For a batch of security controls and standards, this operation updates the enablement status of a control in a standard.\n      </p>",
+        "smithy.api#http": {
+          "method": "PATCH",
+          "uri": "/associations",
+          "code": 200
+        }
+      }
+    },
+    "com.amazonaws.securityhub#BatchUpdateStandardsControlAssociationsRequest": {
+      "type": "structure",
+      "members": {
+        "StandardsControlAssociationUpdates": {
+          "target": "com.amazonaws.securityhub#StandardsControlAssociationUpdates",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         Updates the enablement status of a security control in a specified standard.\n      </p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.securityhub#BatchUpdateStandardsControlAssociationsResponse": {
+      "type": "structure",
+      "members": {
+        "UnprocessedAssociationUpdates": {
+          "target": "com.amazonaws.securityhub#UnprocessedStandardsControlAssociationUpdates",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         A security control (identified with <code>SecurityControlId</code>, <code>SecurityControlArn</code>, or a mix of both parameters) whose enablement status in a specified standard couldn't be updated.\n      </p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
     "com.amazonaws.securityhub#Boolean": {
       "type": "boolean",
       "traits": {
@@ -18589,6 +18800,23 @@
         "smithy.api#documentation": "<p>Container details related to a finding.</p>"
       }
     },
+    "com.amazonaws.securityhub#ControlFindingGenerator": {
+      "type": "enum",
+      "members": {
+        "STANDARD_CONTROL": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "STANDARD_CONTROL"
+          }
+        },
+        "SECURITY_CONTROL": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "SECURITY_CONTROL"
+          }
+        }
+      }
+    },
     "com.amazonaws.securityhub#ControlStatus": {
       "type": "enum",
       "members": {
@@ -18695,7 +18923,7 @@
         "ActionTargetArn": {
           "target": "com.amazonaws.securityhub#NonEmptyString",
           "traits": {
-            "smithy.api#documentation": "<p>The ARN for the custom action target.</p>",
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) for the custom action target.</p>",
             "smithy.api#required": {}
           }
         }
@@ -19228,7 +19456,7 @@
         "ActionTargetArn": {
           "target": "com.amazonaws.securityhub#NonEmptyString",
           "traits": {
-            "smithy.api#documentation": "<p>The ARN of the custom action target to delete.</p>",
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the custom action target to delete.</p>",
             "smithy.api#httpLabel": {},
             "smithy.api#required": {}
           }
@@ -19659,6 +19887,12 @@
             "smithy.api#default": false,
             "smithy.api#documentation": "<p>Whether to automatically enable new controls when they are added to standards that are\n         enabled.</p>\n         <p>If set to <code>true</code>, then new controls for enabled standards are enabled\n         automatically. If set to <code>false</code>, then new controls are not enabled.</p>"
           }
+        },
+        "ControlFindingGenerator": {
+          "target": "com.amazonaws.securityhub#ControlFindingGenerator",
+          "traits": {
+            "smithy.api#documentation": "<p>Specifies whether the calling account has consolidated control findings turned on. If the value for this field is set to \n         <code>SECURITY_CONTROL</code>, Security Hub generates a single finding for a control check even when the check \n         applies to multiple enabled standards.</p>\n         <p>If the value for this field is set to <code>STANDARD_CONTROL</code>, Security Hub generates separate findings \n         for a control check when the check applies to multiple enabled standards.</p>\n         <p>The value for this field in a member account matches the value in the administrator\n         account. For accounts that aren't part of an organization, the default value of this field\n         is <code>SECURITY_CONTROL</code> if you enabled Security Hub on or after February 9,\n         2023.</p>"
+          }
         }
       },
       "traits": {
@@ -20492,6 +20726,12 @@
             "smithy.api#default": false,
             "smithy.api#documentation": "<p>Whether to enable the security standards that Security Hub has designated as automatically\n         enabled. If you do not provide a value for <code>EnableDefaultStandards</code>, it is set\n         to <code>true</code>. To not enable the automatically enabled standards, set\n            <code>EnableDefaultStandards</code> to <code>false</code>.</p>"
           }
+        },
+        "ControlFindingGenerator": {
+          "target": "com.amazonaws.securityhub#ControlFindingGenerator",
+          "traits": {
+            "smithy.api#documentation": "<p>This field, used when enabling Security Hub, specifies whether the calling account has consolidated control findings turned on. \n      If the value for this field is set to \n      <code>SECURITY_CONTROL</code>, Security Hub generates a single finding for a control check even when the check \n      applies to multiple enabled standards.</p>\n         <p>If the value for this field is set to <code>STANDARD_CONTROL</code>, Security Hub generates separate findings \n      for a control check when the check applies to multiple enabled standards.</p>\n         <p>The value for this field in a member account matches the value in the administrator\n         account. For accounts that aren't part of an organization, the default value of this field\n         is <code>SECURITY_CONTROL</code> if you enabled Security Hub on or after February 9,\n         2023.</p>"
+          }
         }
       },
       "traits": {
@@ -22286,96 +22526,273 @@
         "smithy.api#output": {}
       }
     },
-    "com.amazonaws.securityhub#ListTagsForResource": {
+    "com.amazonaws.securityhub#ListSecurityControlDefinitions": {
       "type": "operation",
       "input": {
-        "target": "com.amazonaws.securityhub#ListTagsForResourceRequest"
+        "target": "com.amazonaws.securityhub#ListSecurityControlDefinitionsRequest"
       },
       "output": {
-        "target": "com.amazonaws.securityhub#ListTagsForResourceResponse"
+        "target": "com.amazonaws.securityhub#ListSecurityControlDefinitionsResponse"
       },
       "errors": [
         {
           "target": "com.amazonaws.securityhub#InternalException"
         },
+        {
+          "target": "com.amazonaws.securityhub#InvalidAccessException"
+        },
         {
           "target": "com.amazonaws.securityhub#InvalidInputException"
         },
         {
-          "target": "com.amazonaws.securityhub#ResourceNotFoundException"
+          "target": "com.amazonaws.securityhub#LimitExceededException"
         }
       ],
       "traits": {
-        "smithy.api#documentation": "<p>Returns a list of tags associated with a resource.</p>",
+        "smithy.api#documentation": "<p>\n         Lists all of the security controls that apply to a specified standard. \n      </p>",
         "smithy.api#http": {
           "method": "GET",
-          "uri": "/tags/{ResourceArn}",
+          "uri": "/securityControls/definitions",
           "code": 200
+        },
+        "smithy.api#paginated": {
+          "inputToken": "NextToken",
+          "outputToken": "NextToken",
+          "items": "SecurityControlDefinitions",
+          "pageSize": "MaxResults"
         }
       }
     },
-    "com.amazonaws.securityhub#ListTagsForResourceRequest": {
+    "com.amazonaws.securityhub#ListSecurityControlDefinitionsRequest": {
       "type": "structure",
       "members": {
-        "ResourceArn": {
-          "target": "com.amazonaws.securityhub#ResourceArn",
+        "StandardsArn": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
           "traits": {
-            "smithy.api#documentation": "<p>The ARN of the resource to retrieve tags for.</p>",
-            "smithy.api#httpLabel": {},
-            "smithy.api#required": {}
+            "smithy.api#documentation": "<p>\n         The Amazon Resource Name (ARN) of the standard that you want to view controls for.\n      </p>",
+            "smithy.api#httpQuery": "StandardsArn"
           }
-        }
-      },
-      "traits": {
-        "smithy.api#input": {}
-      }
-    },
-    "com.amazonaws.securityhub#ListTagsForResourceResponse": {
-      "type": "structure",
-      "members": {
-        "Tags": {
-          "target": "com.amazonaws.securityhub#TagMap",
+        },
+        "NextToken": {
+          "target": "com.amazonaws.securityhub#NextToken",
           "traits": {
-            "smithy.api#documentation": "<p>The tags associated with a resource.</p>"
+            "smithy.api#documentation": "<p>\n         Optional pagination parameter.\n      </p>",
+            "smithy.api#httpQuery": "NextToken"
+          }
+        },
+        "MaxResults": {
+          "target": "com.amazonaws.securityhub#MaxResults",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p> An optional parameter that limits the total results of the API response to the\n         specified number. If this parameter isn't provided in the request, the results include the\n         first 25 security controls that apply to the specified standard. The results also include a\n            <code>NextToken</code> parameter that you can use in a subsequent API call to get the\n         next 25 controls. This repeats until all controls for the standard are returned. </p>",
+            "smithy.api#httpQuery": "MaxResults"
           }
         }
       },
       "traits": {
-        "smithy.api#output": {}
+        "smithy.api#input": {}
       }
     },
-    "com.amazonaws.securityhub#LoadBalancerState": {
+    "com.amazonaws.securityhub#ListSecurityControlDefinitionsResponse": {
       "type": "structure",
       "members": {
-        "Code": {
-          "target": "com.amazonaws.securityhub#NonEmptyString",
+        "SecurityControlDefinitions": {
+          "target": "com.amazonaws.securityhub#SecurityControlDefinitions",
           "traits": {
-            "smithy.api#documentation": "<p>The state code. The initial state of the load balancer is provisioning.</p>\n         <p>After the load balancer is fully set up and ready to route traffic, its state is\n         active.</p>\n         <p>If the load balancer could not be set up, its state is failed. </p>"
+            "smithy.api#documentation": "<p>\n         An array of controls that apply to the specified standard.\n      </p>",
+            "smithy.api#required": {}
           }
         },
-        "Reason": {
-          "target": "com.amazonaws.securityhub#NonEmptyString",
+        "NextToken": {
+          "target": "com.amazonaws.securityhub#NextToken",
           "traits": {
-            "smithy.api#documentation": "<p>A description of the state.</p>"
+            "smithy.api#documentation": "<p> A pagination parameter that's included in the response only if it was included in the\n         request. </p>"
           }
         }
       },
       "traits": {
-        "smithy.api#documentation": "<p>Information about the state of the load balancer.</p>"
-      }
-    },
-    "com.amazonaws.securityhub#Long": {
-      "type": "long",
-      "traits": {
-        "smithy.api#default": 0
+        "smithy.api#output": {}
       }
     },
-    "com.amazonaws.securityhub#Malware": {
-      "type": "structure",
-      "members": {
-        "Name": {
-          "target": "com.amazonaws.securityhub#NonEmptyString",
-          "traits": {
+    "com.amazonaws.securityhub#ListStandardsControlAssociations": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.securityhub#ListStandardsControlAssociationsRequest"
+      },
+      "output": {
+        "target": "com.amazonaws.securityhub#ListStandardsControlAssociationsResponse"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.securityhub#InternalException"
+        },
+        {
+          "target": "com.amazonaws.securityhub#InvalidAccessException"
+        },
+        {
+          "target": "com.amazonaws.securityhub#InvalidInputException"
+        },
+        {
+          "target": "com.amazonaws.securityhub#LimitExceededException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>\n         Specifies whether a control is currently enabled or disabled in each enabled standard in the calling account.\n      </p>",
+        "smithy.api#http": {
+          "method": "GET",
+          "uri": "/associations",
+          "code": 200
+        },
+        "smithy.api#paginated": {
+          "inputToken": "NextToken",
+          "outputToken": "NextToken",
+          "items": "StandardsControlAssociationSummaries",
+          "pageSize": "MaxResults"
+        }
+      }
+    },
+    "com.amazonaws.securityhub#ListStandardsControlAssociationsRequest": {
+      "type": "structure",
+      "members": {
+        "SecurityControlId": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         The identifier of the control (identified with <code>SecurityControlId</code>, <code>SecurityControlArn</code>, or a mix of both parameters) that you \n         want to determine the enablement status of in each enabled standard. \n      </p>",
+            "smithy.api#httpQuery": "SecurityControlId",
+            "smithy.api#required": {}
+          }
+        },
+        "NextToken": {
+          "target": "com.amazonaws.securityhub#NextToken",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         Optional pagination parameter.\n      </p>",
+            "smithy.api#httpQuery": "NextToken"
+          }
+        },
+        "MaxResults": {
+          "target": "com.amazonaws.securityhub#MaxResults",
+          "traits": {
+            "smithy.api#default": 0,
+            "smithy.api#documentation": "<p> An optional parameter that limits the total results of the API response to the\n         specified number. If this parameter isn't provided in the request, the results include the\n         first 25 standard and control associations. The results also include a\n            <code>NextToken</code> parameter that you can use in a subsequent API call to get the\n         next 25 associations. This repeats until all associations for the specified control are\n         returned. The number of results is limited by the number of supported Security Hub\n         standards that you've enabled in the calling account. </p>",
+            "smithy.api#httpQuery": "MaxResults"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.securityhub#ListStandardsControlAssociationsResponse": {
+      "type": "structure",
+      "members": {
+        "StandardsControlAssociationSummaries": {
+          "target": "com.amazonaws.securityhub#StandardsControlAssociationSummaries",
+          "traits": {
+            "smithy.api#documentation": "<p> An array that provides the enablement status and other details for each security\n         control that applies to each enabled standard. </p>",
+            "smithy.api#required": {}
+          }
+        },
+        "NextToken": {
+          "target": "com.amazonaws.securityhub#NextToken",
+          "traits": {
+            "smithy.api#documentation": "<p> A pagination parameter that's included in the response only if it was included in the\n         request. </p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.securityhub#ListTagsForResource": {
+      "type": "operation",
+      "input": {
+        "target": "com.amazonaws.securityhub#ListTagsForResourceRequest"
+      },
+      "output": {
+        "target": "com.amazonaws.securityhub#ListTagsForResourceResponse"
+      },
+      "errors": [
+        {
+          "target": "com.amazonaws.securityhub#InternalException"
+        },
+        {
+          "target": "com.amazonaws.securityhub#InvalidInputException"
+        },
+        {
+          "target": "com.amazonaws.securityhub#ResourceNotFoundException"
+        }
+      ],
+      "traits": {
+        "smithy.api#documentation": "<p>Returns a list of tags associated with a resource.</p>",
+        "smithy.api#http": {
+          "method": "GET",
+          "uri": "/tags/{ResourceArn}",
+          "code": 200
+        }
+      }
+    },
+    "com.amazonaws.securityhub#ListTagsForResourceRequest": {
+      "type": "structure",
+      "members": {
+        "ResourceArn": {
+          "target": "com.amazonaws.securityhub#ResourceArn",
+          "traits": {
+            "smithy.api#documentation": "<p>The ARN of the resource to retrieve tags for.</p>",
+            "smithy.api#httpLabel": {},
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#input": {}
+      }
+    },
+    "com.amazonaws.securityhub#ListTagsForResourceResponse": {
+      "type": "structure",
+      "members": {
+        "Tags": {
+          "target": "com.amazonaws.securityhub#TagMap",
+          "traits": {
+            "smithy.api#documentation": "<p>The tags associated with a resource.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#output": {}
+      }
+    },
+    "com.amazonaws.securityhub#LoadBalancerState": {
+      "type": "structure",
+      "members": {
+        "Code": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>The state code. The initial state of the load balancer is provisioning.</p>\n         <p>After the load balancer is fully set up and ready to route traffic, its state is\n         active.</p>\n         <p>If the load balancer could not be set up, its state is failed. </p>"
+          }
+        },
+        "Reason": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>A description of the state.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Information about the state of the load balancer.</p>"
+      }
+    },
+    "com.amazonaws.securityhub#Long": {
+      "type": "long",
+      "traits": {
+        "smithy.api#default": 0
+      }
+    },
+    "com.amazonaws.securityhub#Malware": {
+      "type": "structure",
+      "members": {
+        "Name": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
             "smithy.api#documentation": "<p>The name of the malware that was observed.</p>",
             "smithy.api#required": {}
           }
@@ -23482,6 +23899,23 @@
         "target": "com.amazonaws.securityhub#Record"
       }
     },
+    "com.amazonaws.securityhub#RegionAvailabilityStatus": {
+      "type": "enum",
+      "members": {
+        "AVAILABLE": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "AVAILABLE"
+          }
+        },
+        "UNAVAILABLE": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "UNAVAILABLE"
+          }
+        }
+      }
+    },
     "com.amazonaws.securityhub#RelatedFinding": {
       "type": "structure",
       "members": {
@@ -24651,42 +25085,170 @@
         "smithy.api#documentation": "<p>A list of port ranges.</p>"
       }
     },
-    "com.amazonaws.securityhub#SecurityGroups": {
-      "type": "list",
-      "member": {
-        "target": "com.amazonaws.securityhub#NonEmptyString"
-      }
-    },
-    "com.amazonaws.securityhub#SecurityHubAPIService": {
-      "type": "service",
-      "version": "2018-10-26",
-      "operations": [
-        {
-          "target": "com.amazonaws.securityhub#AcceptAdministratorInvitation"
-        },
-        {
-          "target": "com.amazonaws.securityhub#AcceptInvitation"
+    "com.amazonaws.securityhub#SecurityControl": {
+      "type": "structure",
+      "members": {
+        "SecurityControlId": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         The unique identifier of a security control across standards. Values for this field typically consist of an Amazon Web Service name and a \n         number, such as APIGateway.3.\n      </p>",
+            "smithy.api#required": {}
+          }
         },
-        {
-          "target": "com.amazonaws.securityhub#BatchDisableStandards"
+        "SecurityControlArn": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p> The Amazon Resource Name (ARN) for a security control across standards, such as\n            <code>arn:aws:securityhub:eu-central-1:123456789012:security-control/S3.1</code>. This\n         parameter doesn't mention a specific standard. </p>",
+            "smithy.api#required": {}
+          }
         },
-        {
-          "target": "com.amazonaws.securityhub#BatchEnableStandards"
+        "Title": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>The title of a security control.\n      </p>",
+            "smithy.api#required": {}
+          }
         },
-        {
-          "target": "com.amazonaws.securityhub#BatchImportFindings"
+        "Description": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p> The description of a security control across standards. This typically summarizes how\n            Security Hub evaluates the control and the conditions under which it produces a\n         failed finding. This parameter doesn't reference a specific standard. </p>",
+            "smithy.api#required": {}
+          }
         },
-        {
-          "target": "com.amazonaws.securityhub#BatchUpdateFindings"
+        "RemediationUrl": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         A link to Security Hub documentation that explains how to remediate a failed finding for a security control.\n      </p>",
+            "smithy.api#required": {}
+          }
         },
-        {
-          "target": "com.amazonaws.securityhub#CreateActionTarget"
+        "SeverityRating": {
+          "target": "com.amazonaws.securityhub#SeverityRating",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         The severity of a security control. For more information about how Security Hub determines control severity, see \n         <a href=\"https://docs.aws.amazon.com/securityhub/latest/userguide/controls-findings-create-update.html#control-findings-severity\">Assigning severity to control findings</a> in the \n         <i>Security Hub User Guide</i>.\n      </p>",
+            "smithy.api#required": {}
+          }
         },
-        {
-          "target": "com.amazonaws.securityhub#CreateFindingAggregator"
+        "SecurityControlStatus": {
+          "target": "com.amazonaws.securityhub#ControlStatus",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         The status of a security control based on the compliance status of its findings. For more information about how control \n         status is determined, see <a href=\"https://docs.aws.amazon.com/securityhub/latest/userguide/controls-overall-status.html\">Determining the overall status of a control from its findings</a> in the \n         <i>Security Hub User Guide</i>.\n      </p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>\n         A security control in Security Hub describes a security best practice related to a specific resource. \n      </p>"
+      }
+    },
+    "com.amazonaws.securityhub#SecurityControlDefinition": {
+      "type": "structure",
+      "members": {
+        "SecurityControlId": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         The unique identifier of a security control across standards. Values for this field typically consist of an \n         Amazon Web Service name and a number (for example, APIGateway.3). This parameter differs from \n         <code>SecurityControlArn</code>, which is a unique Amazon Resource Name (ARN) assigned to a control. The \n         ARN references the security control ID (for example, arn:aws:securityhub:eu-central-1:123456789012:security-control/APIGateway.3).\n      </p>",
+            "smithy.api#required": {}
+          }
         },
-        {
-          "target": "com.amazonaws.securityhub#CreateInsight"
+        "Title": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         The title of a security control.\n      </p>",
+            "smithy.api#required": {}
+          }
+        },
+        "Description": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p> The description of a security control across standards. This typically summarizes how\n            Security Hub evaluates the control and the conditions under which it produces a\n         failed finding. This parameter doesn't reference a specific standard. </p>",
+            "smithy.api#required": {}
+          }
+        },
+        "RemediationUrl": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         A link to Security Hub documentation that explains how to remediate a failed finding for a security control.\n      </p>",
+            "smithy.api#required": {}
+          }
+        },
+        "SeverityRating": {
+          "target": "com.amazonaws.securityhub#SeverityRating",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         The severity of a security control. For more information about how Security Hub determines control severity, \n         see <a href=\"https://docs.aws.amazon.com/securityhub/latest/userguide/controls-findings-create-update.html#control-findings-severity\">Assigning severity to control findings</a> in the \n         <i>Security Hub User Guide</i>.\n      </p>",
+            "smithy.api#required": {}
+          }
+        },
+        "CurrentRegionAvailability": {
+          "target": "com.amazonaws.securityhub#RegionAvailabilityStatus",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         Specifies whether a security control is available in the current Amazon Web Services Region.\n      </p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>\n         Provides metadata for a security control, including its unique standard-agnostic identifier, title, description, \n         severity, availability in Amazon Web Services Regions, and a link to remediation steps.\n      </p>"
+      }
+    },
+    "com.amazonaws.securityhub#SecurityControlDefinitions": {
+      "type": "list",
+      "member": {
+        "target": "com.amazonaws.securityhub#SecurityControlDefinition"
+      }
+    },
+    "com.amazonaws.securityhub#SecurityControls": {
+      "type": "list",
+      "member": {
+        "target": "com.amazonaws.securityhub#SecurityControl"
+      }
+    },
+    "com.amazonaws.securityhub#SecurityGroups": {
+      "type": "list",
+      "member": {
+        "target": "com.amazonaws.securityhub#NonEmptyString"
+      }
+    },
+    "com.amazonaws.securityhub#SecurityHubAPIService": {
+      "type": "service",
+      "version": "2018-10-26",
+      "operations": [
+        {
+          "target": "com.amazonaws.securityhub#AcceptAdministratorInvitation"
+        },
+        {
+          "target": "com.amazonaws.securityhub#AcceptInvitation"
+        },
+        {
+          "target": "com.amazonaws.securityhub#BatchDisableStandards"
+        },
+        {
+          "target": "com.amazonaws.securityhub#BatchEnableStandards"
+        },
+        {
+          "target": "com.amazonaws.securityhub#BatchGetSecurityControls"
+        },
+        {
+          "target": "com.amazonaws.securityhub#BatchGetStandardsControlAssociations"
+        },
+        {
+          "target": "com.amazonaws.securityhub#BatchImportFindings"
+        },
+        {
+          "target": "com.amazonaws.securityhub#BatchUpdateFindings"
+        },
+        {
+          "target": "com.amazonaws.securityhub#BatchUpdateStandardsControlAssociations"
+        },
+        {
+          "target": "com.amazonaws.securityhub#CreateActionTarget"
+        },
+        {
+          "target": "com.amazonaws.securityhub#CreateFindingAggregator"
+        },
+        {
+          "target": "com.amazonaws.securityhub#CreateInsight"
         },
         {
           "target": "com.amazonaws.securityhub#CreateMembers"
@@ -24799,6 +25361,12 @@
         {
           "target": "com.amazonaws.securityhub#ListOrganizationAdminAccounts"
         },
+        {
+          "target": "com.amazonaws.securityhub#ListSecurityControlDefinitions"
+        },
+        {
+          "target": "com.amazonaws.securityhub#ListStandardsControlAssociations"
+        },
         {
           "target": "com.amazonaws.securityhub#ListTagsForResource"
         },
@@ -24842,7 +25410,7 @@
           "name": "securityhub"
         },
         "aws.protocols#restJson1": {},
-        "smithy.api#documentation": "<p>Security Hub provides you with a comprehensive view of the security state of your Amazon Web Services environment and resources. It also provides you with the readiness status\n         of your environment based on controls from supported security standards. Security Hub collects\n         security data from Amazon Web Services accounts, services, and integrated third-party products and helps\n         you analyze security trends in your environment to identify the highest priority security\n         issues. For more information about Security Hub, see the <a href=\"https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html\">\n               <i>Security HubUser\n            Guide</i>\n            </a>.</p>\n         <p>When you use operations in the Security Hub API, the requests are executed only in the Amazon Web Services\n         Region that is currently active or in the specific Amazon Web Services Region that you specify in your\n         request. Any configuration or settings change that results from the operation is applied\n         only to that Region. To make the same change in other Regions, execute the same command for\n         each Region to apply the change to.</p>\n         <p>For example, if your Region is set to <code>us-west-2</code>, when you use <code>CreateMembers</code> to add a member account to Security Hub, the association of\n         the member account with the administrator account is created only in the <code>us-west-2</code>\n         Region. Security Hub must be enabled for the member account in the same Region that the invitation\n         was sent from.</p>\n         <p>The following throttling limits apply to using Security Hub API operations.</p>\n         <ul>\n            <li>\n               <p>\n                  <code>BatchEnableStandards</code> - <code>RateLimit</code> of 1\n               request per second, <code>BurstLimit</code> of 1 request per second.</p>\n            </li>\n            <li>\n               <p>\n                  <code>GetFindings</code> - <code>RateLimit</code> of 3 requests per second.\n                  <code>BurstLimit</code> of 6 requests per second.</p>\n            </li>\n            <li>\n               <p>\n                  <code>BatchImportFindings</code> - <code>RateLimit</code> of 10 requests per second.\n            <code>BurstLimit</code> of 30 requests per second.</p>\n            </li>\n            <li>\n               <p>\n                  <code>BatchUpdateFindings</code> - <code>RateLimit</code> of 10 requests per second.\n            <code>BurstLimit</code> of 30 requests per second.</p>\n            </li>\n            <li>\n               <p>\n                  <code>UpdateStandardsControl</code> - <code>RateLimit</code> of\n               1 request per second, <code>BurstLimit</code> of 5 requests per second.</p>\n            </li>\n            <li>\n               <p>All other operations - <code>RateLimit</code> of 10 requests per second.\n                  <code>BurstLimit</code> of 30 requests per second.</p>\n            </li>\n         </ul>",
+        "smithy.api#documentation": "<p>Security Hub provides you with a comprehensive view of the security state of\n         your Amazon Web Services environment and resources. It also provides you with the readiness\n         status of your environment based on controls from supported security standards. Security Hub collects security data from Amazon Web Services accounts, services, and\n         integrated third-party products and helps you analyze security trends in your environment\n         to identify the highest priority security issues. For more information about Security Hub, see the <a href=\"https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html\">Security HubUser\n            Guide</a>.</p>\n         <p>When you use operations in the Security Hub API, the requests are executed only in\n         the Amazon Web Services Region that is currently active or in the specific Amazon Web Services Region that you specify in your request. Any configuration or settings change\n         that results from the operation is applied only to that Region. To make the same change in\n         other Regions, run the same command for each Region in which you want to apply the change.</p>\n         <p>For example, if your Region is set to <code>us-west-2</code>, when you use <code>CreateMembers</code> to add a member account to Security Hub, the association of\n         the member account with the administrator account is created only in the <code>us-west-2</code>\n         Region. Security Hub must be enabled for the member account in the same Region that the invitation\n         was sent from.</p>\n         <p>The following throttling limits apply to using Security Hub API operations.</p>\n         <ul>\n            <li>\n               <p>\n                  <code>BatchEnableStandards</code> - <code>RateLimit</code> of 1 request per\n               second. <code>BurstLimit</code> of 1 request per second.</p>\n            </li>\n            <li>\n               <p>\n                  <code>GetFindings</code> - <code>RateLimit</code> of 3 requests per second.\n                  <code>BurstLimit</code> of 6 requests per second.</p>\n            </li>\n            <li>\n               <p>\n                  <code>BatchImportFindings</code> - <code>RateLimit</code> of 10 requests per second.\n            <code>BurstLimit</code> of 30 requests per second.</p>\n            </li>\n            <li>\n               <p>\n                  <code>BatchUpdateFindings</code> - <code>RateLimit</code> of 10 requests per second.\n            <code>BurstLimit</code> of 30 requests per second.</p>\n            </li>\n            <li>\n               <p>\n                  <code>UpdateStandardsControl</code> - <code>RateLimit</code> of 1 request per\n               second. <code>BurstLimit</code> of 5 requests per second.</p>\n            </li>\n            <li>\n               <p>All other operations - <code>RateLimit</code> of 10 requests per second.\n                  <code>BurstLimit</code> of 30 requests per second.</p>\n            </li>\n         </ul>",
         "smithy.api#title": "AWS SecurityHub",
         "smithy.rules#endpointRuleSet": {
           "version": "1.0",
@@ -25204,9 +25772,9 @@
                 }
               },
               "params": {
-                "Region": "af-south-1",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "af-south-1"
               }
             },
             {
@@ -25217,9 +25785,9 @@
                 }
               },
               "params": {
-                "Region": "ap-east-1",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "ap-east-1"
               }
             },
             {
@@ -25230,9 +25798,9 @@
                 }
               },
               "params": {
-                "Region": "ap-northeast-1",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "ap-northeast-1"
               }
             },
             {
@@ -25243,9 +25811,9 @@
                 }
               },
               "params": {
-                "Region": "ap-northeast-2",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "ap-northeast-2"
               }
             },
             {
@@ -25256,9 +25824,9 @@
                 }
               },
               "params": {
-                "Region": "ap-northeast-3",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "ap-northeast-3"
               }
             },
             {
@@ -25269,9 +25837,9 @@
                 }
               },
               "params": {
-                "Region": "ap-south-1",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "ap-south-1"
               }
             },
             {
@@ -25282,9 +25850,9 @@
                 }
               },
               "params": {
-                "Region": "ap-southeast-1",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "ap-southeast-1"
               }
             },
             {
@@ -25295,9 +25863,9 @@
                 }
               },
               "params": {
-                "Region": "ap-southeast-2",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "ap-southeast-2"
               }
             },
             {
@@ -25308,9 +25876,9 @@
                 }
               },
               "params": {
-                "Region": "ap-southeast-3",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "ap-southeast-3"
               }
             },
             {
@@ -25321,9 +25889,9 @@
                 }
               },
               "params": {
-                "Region": "ca-central-1",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "ca-central-1"
               }
             },
             {
@@ -25334,9 +25902,9 @@
                 }
               },
               "params": {
-                "Region": "eu-central-1",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "eu-central-1"
               }
             },
             {
@@ -25347,9 +25915,9 @@
                 }
               },
               "params": {
-                "Region": "eu-north-1",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "eu-north-1"
               }
             },
             {
@@ -25360,9 +25928,9 @@
                 }
               },
               "params": {
-                "Region": "eu-south-1",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "eu-south-1"
               }
             },
             {
@@ -25373,9 +25941,9 @@
                 }
               },
               "params": {
-                "Region": "eu-west-1",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "eu-west-1"
               }
             },
             {
@@ -25386,9 +25954,9 @@
                 }
               },
               "params": {
-                "Region": "eu-west-2",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "eu-west-2"
               }
             },
             {
@@ -25399,9 +25967,9 @@
                 }
               },
               "params": {
-                "Region": "eu-west-3",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "eu-west-3"
               }
             },
             {
@@ -25412,9 +25980,9 @@
                 }
               },
               "params": {
-                "Region": "me-south-1",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "me-south-1"
               }
             },
             {
@@ -25425,9 +25993,9 @@
                 }
               },
               "params": {
-                "Region": "sa-east-1",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "sa-east-1"
               }
             },
             {
@@ -25438,9 +26006,9 @@
                 }
               },
               "params": {
-                "Region": "us-east-1",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "us-east-1"
               }
             },
             {
@@ -25451,9 +26019,9 @@
                 }
               },
               "params": {
-                "Region": "us-east-1",
                 "UseDualStack": false,
-                "UseFIPS": true
+                "UseFIPS": true,
+                "Region": "us-east-1"
               }
             },
             {
@@ -25464,9 +26032,9 @@
                 }
               },
               "params": {
-                "Region": "us-east-2",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "us-east-2"
               }
             },
             {
@@ -25477,9 +26045,9 @@
                 }
               },
               "params": {
-                "Region": "us-east-2",
                 "UseDualStack": false,
-                "UseFIPS": true
+                "UseFIPS": true,
+                "Region": "us-east-2"
               }
             },
             {
@@ -25490,9 +26058,9 @@
                 }
               },
               "params": {
-                "Region": "us-west-1",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "us-west-1"
               }
             },
             {
@@ -25503,9 +26071,9 @@
                 }
               },
               "params": {
-                "Region": "us-west-1",
                 "UseDualStack": false,
-                "UseFIPS": true
+                "UseFIPS": true,
+                "Region": "us-west-1"
               }
             },
             {
@@ -25516,9 +26084,9 @@
                 }
               },
               "params": {
-                "Region": "us-west-2",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "us-west-2"
               }
             },
             {
@@ -25529,9 +26097,9 @@
                 }
               },
               "params": {
-                "Region": "us-west-2",
                 "UseDualStack": false,
-                "UseFIPS": true
+                "UseFIPS": true,
+                "Region": "us-west-2"
               }
             },
             {
@@ -25542,9 +26110,9 @@
                 }
               },
               "params": {
-                "Region": "us-east-1",
                 "UseDualStack": true,
-                "UseFIPS": true
+                "UseFIPS": true,
+                "Region": "us-east-1"
               }
             },
             {
@@ -25555,9 +26123,9 @@
                 }
               },
               "params": {
-                "Region": "us-east-1",
                 "UseDualStack": true,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "us-east-1"
               }
             },
             {
@@ -25568,9 +26136,9 @@
                 }
               },
               "params": {
-                "Region": "cn-north-1",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "cn-north-1"
               }
             },
             {
@@ -25581,9 +26149,9 @@
                 }
               },
               "params": {
-                "Region": "cn-northwest-1",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "cn-northwest-1"
               }
             },
             {
@@ -25594,9 +26162,9 @@
                 }
               },
               "params": {
-                "Region": "cn-north-1",
                 "UseDualStack": true,
-                "UseFIPS": true
+                "UseFIPS": true,
+                "Region": "cn-north-1"
               }
             },
             {
@@ -25607,9 +26175,9 @@
                 }
               },
               "params": {
-                "Region": "cn-north-1",
                 "UseDualStack": false,
-                "UseFIPS": true
+                "UseFIPS": true,
+                "Region": "cn-north-1"
               }
             },
             {
@@ -25620,9 +26188,9 @@
                 }
               },
               "params": {
-                "Region": "cn-north-1",
                 "UseDualStack": true,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "cn-north-1"
               }
             },
             {
@@ -25633,9 +26201,9 @@
                 }
               },
               "params": {
-                "Region": "us-gov-east-1",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "us-gov-east-1"
               }
             },
             {
@@ -25646,9 +26214,9 @@
                 }
               },
               "params": {
-                "Region": "us-gov-east-1",
                 "UseDualStack": false,
-                "UseFIPS": true
+                "UseFIPS": true,
+                "Region": "us-gov-east-1"
               }
             },
             {
@@ -25659,9 +26227,9 @@
                 }
               },
               "params": {
-                "Region": "us-gov-west-1",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "us-gov-west-1"
               }
             },
             {
@@ -25672,9 +26240,9 @@
                 }
               },
               "params": {
-                "Region": "us-gov-west-1",
                 "UseDualStack": false,
-                "UseFIPS": true
+                "UseFIPS": true,
+                "Region": "us-gov-west-1"
               }
             },
             {
@@ -25685,9 +26253,9 @@
                 }
               },
               "params": {
-                "Region": "us-gov-east-1",
                 "UseDualStack": true,
-                "UseFIPS": true
+                "UseFIPS": true,
+                "Region": "us-gov-east-1"
               }
             },
             {
@@ -25698,9 +26266,9 @@
                 }
               },
               "params": {
-                "Region": "us-gov-east-1",
                 "UseDualStack": true,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "us-gov-east-1"
               }
             },
             {
@@ -25711,9 +26279,9 @@
                 }
               },
               "params": {
-                "Region": "us-iso-east-1",
                 "UseDualStack": false,
-                "UseFIPS": true
+                "UseFIPS": true,
+                "Region": "us-iso-east-1"
               }
             },
             {
@@ -25724,9 +26292,9 @@
                 }
               },
               "params": {
-                "Region": "us-iso-east-1",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "us-iso-east-1"
               }
             },
             {
@@ -25737,9 +26305,9 @@
                 }
               },
               "params": {
-                "Region": "us-isob-east-1",
                 "UseDualStack": false,
-                "UseFIPS": true
+                "UseFIPS": true,
+                "Region": "us-isob-east-1"
               }
             },
             {
@@ -25750,9 +26318,9 @@
                 }
               },
               "params": {
-                "Region": "us-isob-east-1",
                 "UseDualStack": false,
-                "UseFIPS": false
+                "UseFIPS": false,
+                "Region": "us-isob-east-1"
               }
             },
             {
@@ -25763,9 +26331,9 @@
                 }
               },
               "params": {
-                "Region": "us-east-1",
                 "UseDualStack": false,
                 "UseFIPS": false,
+                "Region": "us-east-1",
                 "Endpoint": "https://example.com"
               }
             },
@@ -25788,9 +26356,9 @@
                 "error": "Invalid Configuration: FIPS and custom endpoint are not supported"
               },
               "params": {
-                "Region": "us-east-1",
                 "UseDualStack": false,
                 "UseFIPS": true,
+                "Region": "us-east-1",
                 "Endpoint": "https://example.com"
               }
             },
@@ -25800,9 +26368,9 @@
                 "error": "Invalid Configuration: Dualstack and custom endpoint are not supported"
               },
               "params": {
-                "Region": "us-east-1",
                 "UseDualStack": true,
                 "UseFIPS": false,
+                "Region": "us-east-1",
                 "Endpoint": "https://example.com"
               }
             }
@@ -25908,7 +26476,7 @@
         }
       },
       "traits": {
-        "smithy.api#documentation": "<p>The severity of the finding.</p>\n         <p>The finding provider can provide the initial severity. The finding provider can only\n         update the severity if it has not been updated using\n         <code>BatchUpdateFindings</code>.</p>\n         <p>The finding must have either <code>Label</code> or <code>Normalized</code> populated. If\n         only one of these attributes is populated, then Security Hub automatically populates the other\n         one. If neither attribute is populated, then the finding is invalid. <code>Label</code> is\n         the preferred attribute.</p>"
+        "smithy.api#documentation": "<p>The severity of the finding.</p>\n         <p>The finding provider can provide the initial severity. The finding provider can only\n         update the severity if it hasn't been updated using\n         <code>BatchUpdateFindings</code>.</p>\n         <p>The finding must have either <code>Label</code> or <code>Normalized</code> populated. If\n         only one of these attributes is populated, then Security Hub automatically populates the other\n         one. If neither attribute is populated, then the finding is invalid. <code>Label</code> is\n         the preferred attribute.</p>"
       }
     },
     "com.amazonaws.securityhub#SeverityLabel": {
@@ -26245,6 +26813,231 @@
         "smithy.api#documentation": "<p>Details for an individual security standard control.</p>"
       }
     },
+    "com.amazonaws.securityhub#StandardsControlArnList": {
+      "type": "list",
+      "member": {
+        "target": "com.amazonaws.securityhub#NonEmptyString"
+      }
+    },
+    "com.amazonaws.securityhub#StandardsControlAssociationDetail": {
+      "type": "structure",
+      "members": {
+        "StandardsArn": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         The Amazon Resource Name (ARN) of a security standard.\n      </p>",
+            "smithy.api#required": {}
+          }
+        },
+        "SecurityControlId": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         The unique identifier of a security control across standards. Values for this field typically consist of an Amazon Web Service \n         name and a number, such as APIGateway.3.\n      </p>",
+            "smithy.api#required": {}
+          }
+        },
+        "SecurityControlArn": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p> The ARN of a security control across standards, such as\n            <code>arn:aws:securityhub:eu-central-1:123456789012:security-control/S3.1</code>. This\n         parameter doesn't mention a specific standard. </p>",
+            "smithy.api#required": {}
+          }
+        },
+        "AssociationStatus": {
+          "target": "com.amazonaws.securityhub#AssociationStatus",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         Specifies whether a control is enabled or disabled in a specified standard.\n      </p>",
+            "smithy.api#required": {}
+          }
+        },
+        "RelatedRequirements": {
+          "target": "com.amazonaws.securityhub#RelatedRequirementsList",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         The requirement that underlies a control in the compliance framework related to the standard.\n      </p>"
+          }
+        },
+        "UpdatedAt": {
+          "target": "com.amazonaws.securityhub#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         The time at which the enablement status of the control in the specified standard was last updated.\n      </p>"
+          }
+        },
+        "UpdatedReason": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         The reason for updating the enablement status of a control in a specified standard.\n      </p>"
+          }
+        },
+        "StandardsControlTitle": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         The title of a control. This field may reference a specific standard.\n      </p>"
+          }
+        },
+        "StandardsControlDescription": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         The description of a control. This typically summarizes how Security Hub evaluates the control and the \n         conditions under which it produces a failed finding. This parameter may reference a specific standard. \n      </p>"
+          }
+        },
+        "StandardsControlArns": {
+          "target": "com.amazonaws.securityhub#StandardsControlArnList",
+          "traits": {
+            "smithy.api#documentation": "<p> Provides the input parameter that Security Hub uses to call the <a href=\"https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UpdateStandardsControl.html\">UpdateStandardsControl</a> API. This API can be used to enable or disable a control\n         in a specified standard. </p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p> Provides details about a control's enablement status in a specified standard. </p>"
+      }
+    },
+    "com.amazonaws.securityhub#StandardsControlAssociationDetails": {
+      "type": "list",
+      "member": {
+        "target": "com.amazonaws.securityhub#StandardsControlAssociationDetail"
+      }
+    },
+    "com.amazonaws.securityhub#StandardsControlAssociationId": {
+      "type": "structure",
+      "members": {
+        "SecurityControlId": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         The unique identifier (identified with <code>SecurityControlId</code>, <code>SecurityControlArn</code>, or a mix of both parameters) of a security \n         control across standards.\n      </p>",
+            "smithy.api#required": {}
+          }
+        },
+        "StandardsArn": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         The ARN of a standard.\n      </p>",
+            "smithy.api#required": {}
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>\n         An array with one or more objects that includes a security control (identified with <code>SecurityControlId</code>, <code>SecurityControlArn</code>, or a mix of both parameters) \n         and the Amazon Resource Name (ARN) of a standard. The security control ID or ARN is the same across standards.\n      </p>"
+      }
+    },
+    "com.amazonaws.securityhub#StandardsControlAssociationIds": {
+      "type": "list",
+      "member": {
+        "target": "com.amazonaws.securityhub#StandardsControlAssociationId"
+      }
+    },
+    "com.amazonaws.securityhub#StandardsControlAssociationSummaries": {
+      "type": "list",
+      "member": {
+        "target": "com.amazonaws.securityhub#StandardsControlAssociationSummary"
+      }
+    },
+    "com.amazonaws.securityhub#StandardsControlAssociationSummary": {
+      "type": "structure",
+      "members": {
+        "StandardsArn": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         The Amazon Resource Name (ARN) of a standard.\n      </p>",
+            "smithy.api#required": {}
+          }
+        },
+        "SecurityControlId": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         A unique standard-agnostic identifier for a control. Values for this field typically consist of an \n         Amazon Web Service and a number, such as APIGateway.5. This field doesn't reference a specific standard.\n      </p>",
+            "smithy.api#required": {}
+          }
+        },
+        "SecurityControlArn": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p> The ARN of a control, such as\n            <code>arn:aws:securityhub:eu-central-1:123456789012:security-control/S3.1</code>. This\n         parameter doesn't mention a specific standard. </p>",
+            "smithy.api#required": {}
+          }
+        },
+        "AssociationStatus": {
+          "target": "com.amazonaws.securityhub#AssociationStatus",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         The enablement status of a control in a specific standard.\n      </p>",
+            "smithy.api#required": {}
+          }
+        },
+        "RelatedRequirements": {
+          "target": "com.amazonaws.securityhub#RelatedRequirementsList",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         The requirement that underlies this control in the compliance framework related to the standard.\n      </p>"
+          }
+        },
+        "UpdatedAt": {
+          "target": "com.amazonaws.securityhub#Timestamp",
+          "traits": {
+            "smithy.api#documentation": "<p> The last time that a control's enablement status in a specified standard was updated. </p>"
+          }
+        },
+        "UpdatedReason": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p> The reason for updating the control's enablement status in a specified standard. </p>"
+          }
+        },
+        "StandardsControlTitle": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         The title of a control. \n      </p>"
+          }
+        },
+        "StandardsControlDescription": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         The description of a control. This typically summarizes how Security Hub evaluates the control and the \n         conditions under which it produces a failed finding. The parameter may reference a specific standard.\n      </p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p> An array that provides the enablement status and other details for each control that\n         applies to each enabled standard. </p>"
+      }
+    },
+    "com.amazonaws.securityhub#StandardsControlAssociationUpdate": {
+      "type": "structure",
+      "members": {
+        "StandardsArn": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>The Amazon Resource Name (ARN) of the standard in which you want to update the\n         control's enablement status.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "SecurityControlId": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>The unique identifier for the security control whose enablement status you want to update.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "AssociationStatus": {
+          "target": "com.amazonaws.securityhub#AssociationStatus",
+          "traits": {
+            "smithy.api#documentation": "<p>The desired enablement status of the control in the standard.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "UpdatedReason": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>The reason for updating the control's enablement status in the standard.</p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>An array of requested updates to the enablement status of controls in specified\n         standards. The objects in the array include a security control ID, the Amazon Resource Name (ARN) of the standard, the requested\n         enablement status, and the reason for updating the enablement status.</p>"
+      }
+    },
+    "com.amazonaws.securityhub#StandardsControlAssociationUpdates": {
+      "type": "list",
+      "member": {
+        "target": "com.amazonaws.securityhub#StandardsControlAssociationUpdate"
+      }
+    },
     "com.amazonaws.securityhub#StandardsControls": {
       "type": "list",
       "member": {
@@ -26893,6 +27686,137 @@
         "target": "com.amazonaws.securityhub#NonEmptyString"
       }
     },
+    "com.amazonaws.securityhub#UnprocessedErrorCode": {
+      "type": "enum",
+      "members": {
+        "INVALID_INPUT": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "INVALID_INPUT"
+          }
+        },
+        "ACCESS_DENIED": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "ACCESS_DENIED"
+          }
+        },
+        "NOT_FOUND": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "NOT_FOUND"
+          }
+        },
+        "LIMIT_EXCEEDED": {
+          "target": "smithy.api#Unit",
+          "traits": {
+            "smithy.api#enumValue": "LIMIT_EXCEEDED"
+          }
+        }
+      }
+    },
+    "com.amazonaws.securityhub#UnprocessedSecurityControl": {
+      "type": "structure",
+      "members": {
+        "SecurityControlId": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p> The control (identified with <code>SecurityControlId</code>,\n            <code>SecurityControlArn</code>, or a mix of both parameters) for which a response\n         couldn't be returned. </p>",
+            "smithy.api#required": {}
+          }
+        },
+        "ErrorCode": {
+          "target": "com.amazonaws.securityhub#UnprocessedErrorCode",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         The error code for the unprocessed security control.\n      </p>",
+            "smithy.api#required": {}
+          }
+        },
+        "ErrorReason": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>\n         The reason why the security control was unprocessed.\n      </p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p> Provides details about a security control for which a response couldn't be returned. </p>"
+      }
+    },
+    "com.amazonaws.securityhub#UnprocessedSecurityControls": {
+      "type": "list",
+      "member": {
+        "target": "com.amazonaws.securityhub#UnprocessedSecurityControl"
+      }
+    },
+    "com.amazonaws.securityhub#UnprocessedStandardsControlAssociation": {
+      "type": "structure",
+      "members": {
+        "StandardsControlAssociationId": {
+          "target": "com.amazonaws.securityhub#StandardsControlAssociationId",
+          "traits": {
+            "smithy.api#documentation": "<p> An array with one or more objects that includes a security control (identified with\n            <code>SecurityControlId</code>, <code>SecurityControlArn</code>, or a mix of both\n         parameters) and the Amazon Resource Name (ARN) of a standard. This parameter shows the\n         specific controls for which the enablement status couldn't be retrieved in specified standards when\n         calling <a href=\"https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchUpdateStandardsControlAssociations.html\">BatchUpdateStandardsControlAssociations</a>. </p>",
+            "smithy.api#required": {}
+          }
+        },
+        "ErrorCode": {
+          "target": "com.amazonaws.securityhub#UnprocessedErrorCode",
+          "traits": {
+            "smithy.api#documentation": "<p>The error code for the unprocessed standard and control association.\n      </p>",
+            "smithy.api#required": {}
+          }
+        },
+        "ErrorReason": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>The reason why the standard and control association was unprocessed. </p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p> Provides details about which\n         control's enablement status couldn't be retrieved in a specified standard when calling <a href=\"https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchUpdateStandardsControlAssociations.html\">BatchUpdateStandardsControlAssociations</a>. This parameter also provides details\n         about why the request was unprocessed. </p>"
+      }
+    },
+    "com.amazonaws.securityhub#UnprocessedStandardsControlAssociationUpdate": {
+      "type": "structure",
+      "members": {
+        "StandardsControlAssociationUpdate": {
+          "target": "com.amazonaws.securityhub#StandardsControlAssociationUpdate",
+          "traits": {
+            "smithy.api#documentation": "<p>An array of control and standard associations for which an update failed when calling \n         <a href=\"https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchUpdateStandardsControlAssociations.html\">BatchUpdateStandardsControlAssociations</a>.\n      </p>",
+            "smithy.api#required": {}
+          }
+        },
+        "ErrorCode": {
+          "target": "com.amazonaws.securityhub#UnprocessedErrorCode",
+          "traits": {
+            "smithy.api#documentation": "<p>The error code for the unprocessed update of the control's enablement status in the\n         specified standard.</p>",
+            "smithy.api#required": {}
+          }
+        },
+        "ErrorReason": {
+          "target": "com.amazonaws.securityhub#NonEmptyString",
+          "traits": {
+            "smithy.api#documentation": "<p>The reason why a control's enablement status in the specified standard couldn't be updated. </p>"
+          }
+        }
+      },
+      "traits": {
+        "smithy.api#documentation": "<p>Provides details about which control's enablement status could not be updated in a\n         specified standard when calling the <a href=\"https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchUpdateStandardsControlAssociations.html\">BatchUpdateStandardsControlAssociations</a> API. This parameter also provides\n         details about why the request was unprocessed. </p>"
+      }
+    },
+    "com.amazonaws.securityhub#UnprocessedStandardsControlAssociationUpdates": {
+      "type": "list",
+      "member": {
+        "target": "com.amazonaws.securityhub#UnprocessedStandardsControlAssociationUpdate"
+      }
+    },
+    "com.amazonaws.securityhub#UnprocessedStandardsControlAssociations": {
+      "type": "list",
+      "member": {
+        "target": "com.amazonaws.securityhub#UnprocessedStandardsControlAssociation"
+      }
+    },
     "com.amazonaws.securityhub#UntagResource": {
       "type": "operation",
       "input": {
@@ -27361,6 +28285,12 @@
             "smithy.api#default": false,
             "smithy.api#documentation": "<p>Whether to automatically enable new controls when they are added to standards that are\n         enabled.</p>\n         <p>By default, this is set to <code>true</code>, and new controls are enabled\n         automatically. To not automatically enable new controls, set this to <code>false</code>.\n      </p>"
           }
+        },
+        "ControlFindingGenerator": {
+          "target": "com.amazonaws.securityhub#ControlFindingGenerator",
+          "traits": {
+            "smithy.api#documentation": "<p>Updates whether the calling account has consolidated control findings turned on. \n      If the value for this field is set to \n      <code>SECURITY_CONTROL</code>, Security Hub generates a single finding for a control check even when the check \n      applies to multiple enabled standards.</p>\n         <p>If the value for this field is set to <code>STANDARD_CONTROL</code>, Security Hub generates separate findings \n      for a control check when the check applies to multiple enabled standards.</p>\n         <p>For accounts that are part of an organization, this value can only be updated in the administrator account.</p>"
+          }
         }
       },
       "traits": {