feat: load AWS conformance models from api-models-aws (#1121)

2026-10-15 09:01:31 +00:00 · 2026-09-28 12:21:05 +10:00
parent d8cf17bf6e
commit 0c3403889c
31 changed files with 1887 additions and 201 deletions
@@ -17,7 +17,7 @@ tags:

 ## Overview

-The platform serves **392 operations** across the AWS APIs below. Every page names the operations its service implements from the pinned model, generated from the dispatch tables on each build rather than written by hand.
+The platform serves **394 operations** across the AWS APIs below. Every page names the operations its service implements from the pinned model, generated from the dispatch tables on each build rather than written by hand.

 | Service | Operations |
 |---|---:|
@@ -26,9 +26,9 @@ The platform serves **392 operations** across the AWS APIs below. Every page nam
 | [ECR](/coverage/ecr) | 22 |
 | [ECS](/coverage/ecs) | 31 |
 | [EKS](/coverage/eks) | 36 |
-| [ELBv2](/coverage/elbv2) | 34 |
+| [ELBv2](/coverage/elbv2) | 36 |
 | [IAM](/coverage/iam) | 76 |
 | [RDS](/coverage/rds) | 26 |
 | [S3](/coverage/s3) | 26 |
 | [STS](/coverage/sts) | 5 |
-| **Total** | **392** |
+| **Total** | **394** |
@@ -18,7 +18,7 @@ tags:

 ## Overview

-Spinifex implements **34 operations** in the ELBv2 `2015-12-01` API model.
+Spinifex implements **36 operations** in the ELBv2 `2015-12-01` API model.

 ### Two data planes

@@ -40,6 +40,7 @@ The data plane is a system-managed load balancer VM, launched automatically duri
 | `DeleteTargetGroup` |
 | `DeregisterTargets` |
 | `DescribeAccountLimits` |
+| `DescribeListenerAttributes` |
 | `DescribeListenerCertificates` |
 | `DescribeListeners` |
 | `DescribeLoadBalancerAttributes` |
@@ -51,6 +52,7 @@ The data plane is a system-managed load balancer VM, launched automatically duri
 | `DescribeTargetGroups` |
 | `DescribeTargetHealth` |
 | `ModifyListener` |
+| `ModifyListenerAttributes` |
 | `ModifyLoadBalancerAttributes` |
 | `ModifyRule` |
 | `ModifyTargetGroup` |
@@ -4,29 +4,56 @@ Generated by `make aws-model-coverage`. This file is not published: it carries t

 **Not implemented** is the candidate work. **Not applicable** is declared in `pages.json` and is not work: those operations describe something this platform will not have.

-Pinned model source: `aws-sdk-go v1.55.8`.
+Pinned model source: `github.com/aws/api-models-aws@9b1a49292744, 2026-09-25`.

 ## acm

-`2015-12-08` — 9 of 15 modelled operations implemented (60.0%), 0 stubbed, 0 not applicable, 0 registered outside the pinned model.
+`2015-12-08` — 9 of 40 modelled operations implemented (22.5%), 0 stubbed, 0 not applicable, 0 registered outside the pinned model.

 ### Not implemented

+- `CreateAcmeDomainValidation`
+- `CreateAcmeEndpoint`
+- `CreateAcmeExternalAccountBinding`
+- `DeleteAcmeDomainValidation`
+- `DeleteAcmeEndpoint`
+- `DeleteAcmeExternalAccountBinding`
+- `DescribeAcmeAccount`
+- `DescribeAcmeDomainValidation`
+- `DescribeAcmeEndpoint`
+- `DescribeAcmeExternalAccountBinding`
 - `ExportCertificate`
 - `GetAccountConfiguration`
+- `GetAcmeExternalAccountBindingCredentials`
+- `ListAcmeAccounts`
+- `ListAcmeDomainValidations`
+- `ListAcmeEndpoints`
+- `ListAcmeExternalAccountBindings`
+- `ListCertificateDomainValidations`
+- `ListTagsForResource`
 - `PutAccountConfiguration`
 - `RenewCertificate`
 - `ResendValidationEmail`
+- `RevokeAcmeAccount`
+- `RevokeAcmeExternalAccountBinding`
+- `RevokeCertificate`
+- `SearchCertificates`
+- `TagResource`
+- `UntagResource`
+- `UpdateAcmeDomainValidation`
+- `UpdateAcmeEndpoint`
 - `UpdateCertificateOptions`

 ## ec2

-`2016-11-15` — 127 of 625 modelled operations implemented (20.3%), 0 stubbed, 39 not applicable, 0 registered outside the pinned model.
+`2016-11-15` — 127 of 804 modelled operations implemented (15.8%), 0 stubbed, 39 not applicable, 0 registered outside the pinned model.

 ### Not implemented

 - `AcceptAddressTransfer`
+- `AcceptCapacityReservationBillingOwnership`
 - `AcceptReservedInstancesExchangeQuote`
+- `AcceptTransitGatewayClientVpnAttachment`
 - `AcceptTransitGatewayMulticastDomainAssociations`
 - `AcceptTransitGatewayPeeringAttachment`
 - `AcceptTransitGatewayVpcAttachment`
@@ -39,6 +66,8 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `AssignIpv6Addresses`
 - `AssignPrivateIpAddresses`
 - `AssignPrivateNatGatewayAddress`
+- `AssociateApplicationStatusCheck`
+- `AssociateCapacityReservationBillingOwner`
 - `AssociateClientVpnTargetNetwork`
 - `AssociateDhcpOptions`
 - `AssociateEnclaveCertificateIamRole`
@@ -46,23 +75,34 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `AssociateIpamByoasn`
 - `AssociateIpamResourceDiscovery`
 - `AssociateNatGatewayAddress`
+- `AssociateRouteServer`
+- `AssociateSecurityGroupVpc`
 - `AssociateSubnetCidrBlock`
 - `AssociateTransitGatewayMulticastDomain`
 - `AssociateTransitGatewayPolicyTable`
 - `AssociateTransitGatewayRouteTable`
 - `AssociateTrunkInterface`
 - `AssociateVpcCidrBlock`
+- `AttachImageWatermark`
 - `AttachVerifiedAccessTrustProvider`
 - `AttachVpnGateway`
 - `AuthorizeClientVpnIngress`
+- `BatchModifyIpamRoutingPolicyRegistrations`
 - `BundleInstance`
 - `CancelBundleTask`
 - `CancelCapacityReservationFleets`
 - `CancelConversionTask`
+- `CancelDeclarativePoliciesReport`
 - `CancelExportTask`
 - `CancelImageLaunchPermission`
 - `CancelImportTask`
 - `CancelSpotFleetRequests`
+- `CopyVolumes`
+- `CreateApplicationStatusCheck`
+- `CreateCapacityManagerDataExport`
+- `CreateCapacityReservationBySplitting`
+- `CreateCapacityReservationCancellationQuote`
+- `CreateCapacityReservationDateChangeQuote`
 - `CreateCapacityReservationFleet`
 - `CreateClientVpnEndpoint`
 - `CreateClientVpnRoute`
@@ -71,21 +111,32 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `CreateCustomerGateway`
 - `CreateDefaultSubnet`
 - `CreateDefaultVpc`
+- `CreateDelegateMacVolumeOwnershipTask`
 - `CreateDhcpOptions`
 - `CreateFleet`
 - `CreateFlowLogs`
+- `CreateImageUsageReport`
 - `CreateInstanceConnectEndpoint`
 - `CreateInstanceEventWindow`
 - `CreateInstanceExportTask`
+- `CreateInterruptibleCapacityReservationAllocation`
 - `CreateIpam`
 - `CreateIpamExternalResourceVerificationToken`
+- `CreateIpamInternetRegistryAssociation`
+- `CreateIpamPolicy`
 - `CreateIpamPool`
+- `CreateIpamPrefixListResolver`
+- `CreateIpamPrefixListResolverTarget`
 - `CreateIpamResourceDiscovery`
+- `CreateIpamRoutingPolicyRegistration`
 - `CreateIpamScope`
 - `CreateLocalGatewayRoute`
 - `CreateLocalGatewayRouteTable`
 - `CreateLocalGatewayRouteTableVirtualInterfaceGroupAssociation`
 - `CreateLocalGatewayRouteTableVpcAssociation`
+- `CreateLocalGatewayVirtualInterface`
+- `CreateLocalGatewayVirtualInterfaceGroup`
+- `CreateMacSystemIntegrityProtectionModificationTask`
 - `CreateManagedPrefixList`
 - `CreateNetworkAcl`
 - `CreateNetworkAclEntry`
@@ -95,6 +146,11 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `CreatePublicIpv4Pool`
 - `CreateReplaceRootVolumeTask`
 - `CreateRestoreImageTask`
+- `CreateRouteServer`
+- `CreateRouteServerEndpoint`
+- `CreateRouteServerPeer`
+- `CreateSecondaryNetwork`
+- `CreateSecondarySubnet`
 - `CreateSnapshots`
 - `CreateSpotDatafeedSubscription`
 - `CreateStoreImageTask`
@@ -106,9 +162,12 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `CreateTransitGateway`
 - `CreateTransitGatewayConnect`
 - `CreateTransitGatewayConnectPeer`
+- `CreateTransitGatewayMeteringPolicy`
+- `CreateTransitGatewayMeteringPolicyEntry`
 - `CreateTransitGatewayMulticastDomain`
 - `CreateTransitGatewayPeeringAttachment`
 - `CreateTransitGatewayPolicyTable`
+- `CreateTransitGatewayPolicyTableEntry`
 - `CreateTransitGatewayPrefixListReference`
 - `CreateTransitGatewayRoute`
 - `CreateTransitGatewayRouteTable`
@@ -118,13 +177,18 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `CreateVerifiedAccessGroup`
 - `CreateVerifiedAccessInstance`
 - `CreateVerifiedAccessTrustProvider`
+- `CreateVpcBlockPublicAccessExclusion`
+- `CreateVpcEncryptionControl`
 - `CreateVpcEndpoint`
 - `CreateVpcEndpointConnectionNotification`
 - `CreateVpcEndpointServiceConfiguration`
 - `CreateVpcPeeringConnection`
+- `CreateVpnConcentrator`
 - `CreateVpnConnection`
 - `CreateVpnConnectionRoute`
 - `CreateVpnGateway`
+- `DeleteApplicationStatusCheck`
+- `DeleteCapacityManagerDataExport`
 - `DeleteClientVpnEndpoint`
 - `DeleteClientVpnRoute`
 - `DeleteCoipCidr`
@@ -133,17 +197,25 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `DeleteDhcpOptions`
 - `DeleteFleets`
 - `DeleteFlowLogs`
+- `DeleteImageUsageReport`
 - `DeleteInstanceConnectEndpoint`
 - `DeleteInstanceEventWindow`
 - `DeleteIpam`
 - `DeleteIpamExternalResourceVerificationToken`
+- `DeleteIpamInternetRegistryAssociation`
+- `DeleteIpamPolicy`
 - `DeleteIpamPool`
+- `DeleteIpamPrefixListResolver`
+- `DeleteIpamPrefixListResolverTarget`
 - `DeleteIpamResourceDiscovery`
+- `DeleteIpamRoutingPolicyRegistration`
 - `DeleteIpamScope`
 - `DeleteLocalGatewayRoute`
 - `DeleteLocalGatewayRouteTable`
 - `DeleteLocalGatewayRouteTableVirtualInterfaceGroupAssociation`
 - `DeleteLocalGatewayRouteTableVpcAssociation`
+- `DeleteLocalGatewayVirtualInterface`
+- `DeleteLocalGatewayVirtualInterfaceGroup`
 - `DeleteManagedPrefixList`
 - `DeleteNetworkAcl`
 - `DeleteNetworkAclEntry`
@@ -154,6 +226,11 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `DeleteNetworkInterfacePermission`
 - `DeletePublicIpv4Pool`
 - `DeleteQueuedReservedInstances`
+- `DeleteRouteServer`
+- `DeleteRouteServerEndpoint`
+- `DeleteRouteServerPeer`
+- `DeleteSecondaryNetwork`
+- `DeleteSecondarySubnet`
 - `DeleteSpotDatafeedSubscription`
 - `DeleteSubnetCidrReservation`
 - `DeleteTrafficMirrorFilter`
@@ -161,11 +238,15 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `DeleteTrafficMirrorSession`
 - `DeleteTrafficMirrorTarget`
 - `DeleteTransitGateway`
+- `DeleteTransitGatewayClientVpnAttachment`
 - `DeleteTransitGatewayConnect`
 - `DeleteTransitGatewayConnectPeer`
+- `DeleteTransitGatewayMeteringPolicy`
+- `DeleteTransitGatewayMeteringPolicyEntry`
 - `DeleteTransitGatewayMulticastDomain`
 - `DeleteTransitGatewayPeeringAttachment`
 - `DeleteTransitGatewayPolicyTable`
+- `DeleteTransitGatewayPolicyTableEntry`
 - `DeleteTransitGatewayPrefixListReference`
 - `DeleteTransitGatewayRoute`
 - `DeleteTransitGatewayRouteTable`
@@ -175,10 +256,13 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `DeleteVerifiedAccessGroup`
 - `DeleteVerifiedAccessInstance`
 - `DeleteVerifiedAccessTrustProvider`
+- `DeleteVpcBlockPublicAccessExclusion`
+- `DeleteVpcEncryptionControl`
 - `DeleteVpcEndpointConnectionNotifications`
 - `DeleteVpcEndpointServiceConfigurations`
 - `DeleteVpcEndpoints`
 - `DeleteVpcPeeringConnection`
+- `DeleteVpnConcentrator`
 - `DeleteVpnConnection`
 - `DeleteVpnConnectionRoute`
 - `DeleteVpnGateway`
@@ -189,11 +273,24 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `DeregisterInstanceEventNotificationAttributes`
 - `DeregisterTransitGatewayMulticastGroupMembers`
 - `DeregisterTransitGatewayMulticastGroupSources`
+- `DescribeAccountVpcEncryptionControl`
 - `DescribeAddressTransfers`
+- `DescribeApplicationStatus`
+- `DescribeApplicationStatusCheckAssociations`
+- `DescribeApplicationStatusChecks`
 - `DescribeBundleTasks`
 - `DescribeByoipCidrs`
+- `DescribeCapacityBlockExtensionHistory`
+- `DescribeCapacityBlockExtensionOfferings`
 - `DescribeCapacityBlockOfferings`
+- `DescribeCapacityBlockStatus`
+- `DescribeCapacityBlocks`
+- `DescribeCapacityManagerDataExports`
+- `DescribeCapacityReservationBillingRequests`
+- `DescribeCapacityReservationCancellationQuotes`
+- `DescribeCapacityReservationDateChangeQuotes`
 - `DescribeCapacityReservationFleets`
+- `DescribeCapacityReservationTopology`
 - `DescribeClientVpnAuthorizationRules`
 - `DescribeClientVpnConnections`
 - `DescribeClientVpnEndpoints`
@@ -202,6 +299,7 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `DescribeCoipPools`
 - `DescribeConversionTasks`
 - `DescribeCustomerGateways`
+- `DescribeDeclarativePoliciesReports`
 - `DescribeDhcpOptions`
 - `DescribeExportImageTasks`
 - `DescribeExportTasks`
@@ -214,15 +312,26 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `DescribeHostReservationOfferings`
 - `DescribeHostReservations`
 - `DescribeHosts`
+- `DescribeImageReferences`
+- `DescribeImageUsageReportEntries`
+- `DescribeImageUsageReports`
 - `DescribeImportImageTasks`
 - `DescribeImportSnapshotTasks`
 - `DescribeInstanceConnectEndpoints`
 - `DescribeInstanceEventNotificationAttributes`
 - `DescribeInstanceEventWindows`
+- `DescribeInstanceImageMetadata`
+- `DescribeInstanceSqlHaHistoryStates`
+- `DescribeInstanceSqlHaStates`
 - `DescribeInstanceTopology`
 - `DescribeIpamByoasn`
 - `DescribeIpamExternalResourceVerificationTokens`
+- `DescribeIpamInternetRegistryAssociations`
+- `DescribeIpamPolicies`
+- `DescribeIpamPoolAllocations`
 - `DescribeIpamPools`
+- `DescribeIpamPrefixListResolverTargets`
+- `DescribeIpamPrefixListResolvers`
 - `DescribeIpamResourceDiscoveries`
 - `DescribeIpamResourceDiscoveryAssociations`
 - `DescribeIpamScopes`
@@ -236,6 +345,7 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `DescribeLocalGateways`
 - `DescribeLockedSnapshots`
 - `DescribeMacHosts`
+- `DescribeMacModificationTasks`
 - `DescribeManagedPrefixLists`
 - `DescribeNetworkAcls`
 - `DescribeNetworkInsightsAccessScopeAnalyses`
@@ -244,15 +354,24 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `DescribeNetworkInsightsPaths`
 - `DescribeNetworkInterfaceAttribute`
 - `DescribeNetworkInterfacePermissions`
+- `DescribeOutpostLags`
 - `DescribePrefixLists`
 - `DescribePublicIpv4Pools`
 - `DescribeReplaceRootVolumeTasks`
 - `DescribeReservedInstances`
 - `DescribeReservedInstancesModifications`
 - `DescribeReservedInstancesOfferings`
+- `DescribeRouteServerEndpoints`
+- `DescribeRouteServerPeers`
+- `DescribeRouteServers`
 - `DescribeScheduledInstanceAvailability`
 - `DescribeScheduledInstances`
+- `DescribeSecondaryInterfaces`
+- `DescribeSecondaryNetworks`
+- `DescribeSecondarySubnets`
 - `DescribeSecurityGroupReferences`
+- `DescribeSecurityGroupVpcAssociations`
+- `DescribeServiceLinkVirtualInterfaces`
 - `DescribeSnapshotAttribute`
 - `DescribeSnapshotTierStatus`
 - `DescribeSpotDatafeedSubscription`
@@ -268,6 +387,7 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `DescribeTransitGatewayAttachments`
 - `DescribeTransitGatewayConnectPeers`
 - `DescribeTransitGatewayConnects`
+- `DescribeTransitGatewayMeteringPolicies`
 - `DescribeTransitGatewayMulticastDomains`
 - `DescribeTransitGatewayPeeringAttachments`
 - `DescribeTransitGatewayPolicyTables`
@@ -282,33 +402,49 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `DescribeVerifiedAccessInstances`
 - `DescribeVerifiedAccessTrustProviders`
 - `DescribeVolumeAttribute`
+- `DescribeVpcBlockPublicAccessExclusions`
+- `DescribeVpcBlockPublicAccessOptions`
+- `DescribeVpcEncryptionControls`
+- `DescribeVpcEndpointAssociations`
 - `DescribeVpcEndpointConnectionNotifications`
 - `DescribeVpcEndpointConnections`
 - `DescribeVpcEndpointServiceConfigurations`
 - `DescribeVpcEndpointServicePermissions`
 - `DescribeVpcEndpointServices`
 - `DescribeVpcPeeringConnections`
+- `DescribeVpnConcentrators`
 - `DescribeVpnConnections`
 - `DescribeVpnGateways`
+- `DetachImageWatermark`
 - `DetachVerifiedAccessTrustProvider`
 - `DetachVpnGateway`
 - `DisableAddressTransfer`
+- `DisableAllowedImagesSettings`
+- `DisableApplicationStatusCheckSuppression`
+- `DisableCapacityManager`
 - `DisableFastLaunch`
 - `DisableFastSnapshotRestores`
 - `DisableImage`
 - `DisableImageBlockPublicAccess`
 - `DisableImageDeprecation`
 - `DisableImageDeregistrationProtection`
+- `DisableInstanceSqlHaStandbyDetections`
 - `DisableIpamOrganizationAdminAccount`
+- `DisableIpamPolicy`
+- `DisableRouteServerPropagation`
 - `DisableSnapshotBlockPublicAccess`
 - `DisableTransitGatewayRouteTablePropagation`
 - `DisableVgwRoutePropagation`
+- `DisassociateApplicationStatusCheck`
+- `DisassociateCapacityReservationBillingOwner`
 - `DisassociateClientVpnTargetNetwork`
 - `DisassociateEnclaveCertificateIamRole`
 - `DisassociateInstanceEventWindow`
 - `DisassociateIpamByoasn`
 - `DisassociateIpamResourceDiscovery`
 - `DisassociateNatGatewayAddress`
+- `DisassociateRouteServer`
+- `DisassociateSecurityGroupVpc`
 - `DisassociateSubnetCidrBlock`
 - `DisassociateTransitGatewayMulticastDomain`
 - `DisassociateTransitGatewayPolicyTable`
@@ -316,14 +452,21 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `DisassociateTrunkInterface`
 - `DisassociateVpcCidrBlock`
 - `EnableAddressTransfer`
+- `EnableAllowedImagesSettings`
+- `EnableApplicationStatusCheckSuppression`
+- `EnableCapacityManager`
 - `EnableFastLaunch`
 - `EnableFastSnapshotRestores`
 - `EnableImage`
 - `EnableImageBlockPublicAccess`
 - `EnableImageDeprecation`
 - `EnableImageDeregistrationProtection`
+- `EnableInstanceSqlHaStandbyDetections`
+- `EnableIpamInternetRegistryAssociation`
 - `EnableIpamOrganizationAdminAccount`
+- `EnableIpamPolicy`
 - `EnableReachabilityAnalyzerOrganizationSharing`
+- `EnableRouteServerPropagation`
 - `EnableSnapshotBlockPublicAccess`
 - `EnableTransitGatewayRouteTablePropagation`
 - `EnableVgwRoutePropagation`
@@ -332,16 +475,26 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `ExportClientVpnClientConfiguration`
 - `ExportImage`
 - `ExportTransitGatewayRoutes`
+- `ExportVerifiedAccessInstanceClientConfiguration`
+- `GetActiveVpnTunnelStatus`
+- `GetAllowedImagesSettings`
 - `GetAssociatedEnclaveCertificateIamRoles`
 - `GetAssociatedIpv6PoolCidrs`
+- `GetCapacityManagerAttributes`
+- `GetCapacityManagerMetricData`
+- `GetCapacityManagerMetricDimensions`
+- `GetCapacityManagerMonitoredTagKeys`
 - `GetCapacityReservationUsage`
 - `GetCoipPoolUsage`
 - `GetConsoleScreenshot`
+- `GetDeclarativePoliciesReportSummary`
 - `GetDefaultCreditSpecification`
 - `GetEbsDefaultKmsKeyId`
+- `GetEnabledIpamPolicy`
 - `GetFlowLogsIntegrationTemplate`
 - `GetGroupsForCapacityReservation`
 - `GetHostReservationPurchasePreview`
+- `GetImageAncestry`
 - `GetImageBlockPublicAccessState`
 - `GetInstanceMetadataDefaults`
 - `GetInstanceTpmEkPub`
@@ -351,19 +504,36 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `GetIpamDiscoveredAccounts`
 - `GetIpamDiscoveredPublicAddresses`
 - `GetIpamDiscoveredResourceCidrs`
+- `GetIpamDiscoveredRoutes`
+- `GetIpamInternetRegistryAssociationAsns`
+- `GetIpamInternetRegistryAssociationCidrs`
+- `GetIpamPolicyAllocationRules`
+- `GetIpamPolicyOrganizationTargets`
 - `GetIpamPoolAllocations`
 - `GetIpamPoolCidrs`
+- `GetIpamPrefixListResolverRules`
+- `GetIpamPrefixListResolverVersionEntries`
+- `GetIpamPrefixListResolverVersions`
 - `GetIpamResourceCidrs`
+- `GetIpamRouteOriginAuthorizations`
+- `GetIpamRouteProtectionFindings`
+- `GetIpamRoutingPolicyRegistrationDeltas`
+- `GetIpamRoutingPolicyRegistrations`
 - `GetLaunchTemplateData`
 - `GetManagedPrefixListAssociations`
 - `GetManagedPrefixListEntries`
+- `GetManagedResourceVisibility`
 - `GetNetworkInsightsAccessScopeAnalysisFindings`
 - `GetNetworkInsightsAccessScopeContent`
 - `GetReservedInstancesExchangeQuote`
+- `GetRouteServerAssociations`
+- `GetRouteServerPropagations`
+- `GetRouteServerRoutingDatabase`
 - `GetSnapshotBlockPublicAccessState`
 - `GetSpotPlacementScores`
 - `GetSubnetCidrReservations`
 - `GetTransitGatewayAttachmentPropagations`
+- `GetTransitGatewayMeteringPolicyEntries`
 - `GetTransitGatewayMulticastDomainAssociations`
 - `GetTransitGatewayPolicyTableAssociations`
 - `GetTransitGatewayPolicyTableEntries`
@@ -371,7 +541,9 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `GetTransitGatewayRouteTableAssociations`
 - `GetTransitGatewayRouteTablePropagations`
 - `GetVerifiedAccessEndpointPolicy`
+- `GetVerifiedAccessEndpointTargets`
 - `GetVerifiedAccessGroupPolicy`
+- `GetVpcResourcesBlockingEncryptionEnforcement`
 - `GetVpnConnectionDeviceSampleConfiguration`
 - `GetVpnConnectionDeviceTypes`
 - `GetVpnTunnelReplacementStatus`
@@ -382,8 +554,11 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `ImportVolume`
 - `ListImagesInRecycleBin`
 - `ListSnapshotsInRecycleBin`
+- `ListVolumesInRecycleBin`
 - `LockSnapshot`
+- `ModifyAccountVpcEncryptionControl`
 - `ModifyAddressAttribute`
+- `ModifyApplicationStatusCheck`
 - `ModifyAvailabilityZoneGroup`
 - `ModifyCapacityReservation`
 - `ModifyCapacityReservationFleet`
@@ -393,21 +568,32 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `ModifyFleet`
 - `ModifyHosts`
 - `ModifyInstanceCapacityReservationAttributes`
+- `ModifyInstanceConnectEndpoint`
+- `ModifyInstanceCpuOptions`
 - `ModifyInstanceCreditSpecification`
 - `ModifyInstanceEventStartTime`
 - `ModifyInstanceEventWindow`
 - `ModifyInstanceMaintenanceOptions`
 - `ModifyInstanceMetadataDefaults`
+- `ModifyInstanceNetworkPerformanceOptions`
 - `ModifyInstancePlacement`
 - `ModifyIpam`
+- `ModifyIpamPolicyAllocationRules`
 - `ModifyIpamPool`
+- `ModifyIpamPoolAllocation`
+- `ModifyIpamPrefixListResolver`
+- `ModifyIpamPrefixListResolverTarget`
 - `ModifyIpamResourceCidr`
 - `ModifyIpamResourceDiscovery`
+- `ModifyIpamRoutingPolicyRegistration`
 - `ModifyIpamScope`
 - `ModifyLocalGatewayRoute`
 - `ModifyManagedPrefixList`
+- `ModifyManagedResourceVisibility`
 - `ModifyPrivateDnsNameOptions`
+- `ModifyPublicIpDnsNameOptions`
 - `ModifyReservedInstances`
+- `ModifyRouteServer`
 - `ModifySnapshotAttribute`
 - `ModifySnapshotTier`
 - `ModifySpotFleetRequest`
@@ -415,6 +601,8 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `ModifyTrafficMirrorFilterRule`
 - `ModifyTrafficMirrorSession`
 - `ModifyTransitGateway`
+- `ModifyTransitGatewayMeteringPolicy`
+- `ModifyTransitGatewayPolicyTableEntry`
 - `ModifyTransitGatewayPrefixListReference`
 - `ModifyTransitGatewayVpcAttachment`
 - `ModifyVerifiedAccessEndpoint`
@@ -425,8 +613,12 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `ModifyVerifiedAccessInstanceLoggingConfiguration`
 - `ModifyVerifiedAccessTrustProvider`
 - `ModifyVolumeAttribute`
+- `ModifyVpcBlockPublicAccessExclusion`
+- `ModifyVpcBlockPublicAccessOptions`
+- `ModifyVpcEncryptionControl`
 - `ModifyVpcEndpoint`
 - `ModifyVpcEndpointConnectionNotification`
+- `ModifyVpcEndpointPayerResponsibility`
 - `ModifyVpcEndpointServiceConfiguration`
 - `ModifyVpcEndpointServicePayerResponsibility`
 - `ModifyVpcEndpointServicePermissions`
@@ -437,17 +629,21 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `ModifyVpnTunnelCertificate`
 - `ModifyVpnTunnelOptions`
 - `MoveByoipCidrToIpam`
+- `MoveCapacityReservationInstances`
 - `ProvisionByoipCidr`
 - `ProvisionIpamByoasn`
 - `ProvisionIpamPoolCidr`
 - `ProvisionPublicIpv4PoolCidr`
 - `PurchaseCapacityBlock`
+- `PurchaseCapacityBlockExtension`
 - `PurchaseHostReservation`
 - `PurchaseReservedInstancesOffering`
 - `PurchaseScheduledInstances`
 - `RegisterInstanceEventNotificationAttributes`
 - `RegisterTransitGatewayMulticastGroupMembers`
 - `RegisterTransitGatewayMulticastGroupSources`
+- `RejectCapacityReservationBillingOwnership`
+- `RejectTransitGatewayClientVpnAttachment`
 - `RejectTransitGatewayMulticastDomainAssociations`
 - `RejectTransitGatewayPeeringAttachment`
 - `RejectTransitGatewayVpcAttachment`
@@ -455,6 +651,8 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `RejectVpcPeeringConnection`
 - `ReleaseHosts`
 - `ReleaseIpamPoolAllocation`
+- `ReplaceImageCriteriaInAllowedImagesSettings`
+- `ReplaceImageInstanceTypeSpecification`
 - `ReplaceNetworkAclAssociation`
 - `ReplaceNetworkAclEntry`
 - `ReplaceTransitGatewayRoute`
@@ -469,12 +667,14 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `RestoreManagedPrefixListVersion`
 - `RestoreSnapshotFromRecycleBin`
 - `RestoreSnapshotTier`
+- `RestoreVolumeFromRecycleBin`
 - `RevokeClientVpnIngress`
 - `RunScheduledInstances`
 - `SearchLocalGatewayRoutes`
 - `SearchTransitGatewayMulticastGroups`
 - `SearchTransitGatewayRoutes`
 - `SendDiagnosticInterrupt`
+- `StartDeclarativePoliciesReport`
 - `StartNetworkInsightsAccessScopeAnalysis`
 - `StartNetworkInsightsAnalysis`
 - `StartVpcEndpointServicePrivateDnsVerification`
@@ -483,6 +683,10 @@ Pinned model source: `aws-sdk-go v1.55.8`.
 - `UnassignPrivateIpAddresses`
 - `UnassignPrivateNatGatewayAddress`
 - `UnlockSnapshot`
+- `UpdateCapacityManagerMonitoredTagKeys`
+- `UpdateCapacityManagerOrganizationsAccess`
+- `UpdateInterruptibleCapacityReservationAllocation`
+- `ValidateSecurityGroupQuotasForInterface`
 - `WithdrawByoipCidr`

 ### Not applicable — do not build
@@ -558,7 +762,7 @@ spot-price: On owned hardware there is no spot-to-on-demand price differential,

 ## ecr

-`2015-09-21` — 22 of 47 modelled operations implemented (46.8%), 11 stubbed, 0 not applicable, 3 registered outside the pinned model.
+`2015-09-21` — 22 of 58 modelled operations implemented (37.9%), 11 stubbed, 0 not applicable, 3 registered outside the pinned model.

 ### Not implemented

@@ -567,9 +771,20 @@ spot-price: On owned hardware there is no spot-to-on-demand price differential,
 - `DeletePullThroughCacheRule`
 - `DeleteRegistryPolicy`
 - `DeleteRepositoryCreationTemplate`
+- `DeleteSigningConfiguration`
+- `DeregisterPullTimeUpdateExclusion`
 - `DescribeImageReplicationStatus`
+- `DescribeImageSigningStatus`
 - `DescribePullThroughCacheRules`
 - `DescribeRepositoryCreationTemplates`
+- `GetAccountSetting`
+- `GetSigningConfiguration`
+- `ListImageReferrers`
+- `ListPullTimeUpdateExclusions`
+- `PutAccountSetting`
+- `PutSigningConfiguration`
+- `RegisterPullTimeUpdateExclusion`
+- `UpdateImageStorageClass`
 - `UpdatePullThroughCacheRule`
 - `UpdateRepositoryCreationTemplate`
 - `ValidatePullThroughCacheRule`
@@ -605,27 +820,48 @@ spot-price: On owned hardware there is no spot-to-on-demand price differential,

 ## ecs

-`2014-11-13` — 31 of 56 modelled operations implemented (55.4%), 5 stubbed, 0 not applicable, 3 registered outside the pinned model.
+`2014-11-13` — 31 of 77 modelled operations implemented (40.3%), 5 stubbed, 0 not applicable, 3 registered outside the pinned model.

 ### Not implemented

+- `ContinueServiceDeployment`
+- `CreateDaemon`
+- `CreateExpressGatewayService`
 - `CreateTaskSet`
 - `DeleteAccountSetting`
 - `DeleteAttributes`
+- `DeleteDaemon`
+- `DeleteDaemonTaskDefinition`
+- `DeleteExpressGatewayService`
 - `DeleteTaskDefinitions`
 - `DeleteTaskSet`
+- `DescribeDaemon`
+- `DescribeDaemonDeployments`
+- `DescribeDaemonRevisions`
+- `DescribeDaemonTaskDefinition`
+- `DescribeExpressGatewayService`
+- `DescribeServiceDeployments`
+- `DescribeServiceRevisions`
 - `DescribeTaskSets`
 - `DiscoverPollEndpoint`
 - `ExecuteCommand`
 - `GetTaskProtection`
 - `ListAttributes`
+- `ListDaemonDeployments`
+- `ListDaemonTaskDefinitions`
+- `ListDaemons`
+- `ListServiceDeployments`
 - `PutAccountSettingDefault`
 - `PutAttributes`
+- `RegisterDaemonTaskDefinition`
+- `StopServiceDeployment`
 - `SubmitAttachmentStateChanges`
 - `SubmitContainerStateChange`
 - `UpdateCapacityProvider`
 - `UpdateClusterSettings`
 - `UpdateContainerAgent`
+- `UpdateDaemon`
+- `UpdateExpressGatewayService`
 - `UpdateServicePrimaryTaskSet`
 - `UpdateTaskProtection`
 - `UpdateTaskSet`
@@ -646,28 +882,42 @@ spot-price: On owned hardware there is no spot-to-on-demand price differential,

 ## eks

-`2017-11-01` — 36 of 56 modelled operations implemented (64.3%), 0 stubbed, 0 not applicable, 4 registered outside the pinned model.
+`2017-11-01` — 36 of 70 modelled operations implemented (51.4%), 0 stubbed, 0 not applicable, 4 registered outside the pinned model.

 ### Not implemented

+- `ActivateCertificateAuthority`
 - `AssociateEncryptionConfig`
+- `CancelUpdate`
+- `CreateCapability`
+- `CreateCertificateAuthority`
 - `CreateEksAnywhereSubscription`
 - `CreateFargateProfile`
 - `CreatePodIdentityAssociation`
+- `DeleteCapability`
+- `DeleteCertificateAuthority`
 - `DeleteEksAnywhereSubscription`
 - `DeleteFargateProfile`
 - `DeletePodIdentityAssociation`
 - `DeregisterCluster`
 - `DescribeAddonConfiguration`
+- `DescribeCapability`
+- `DescribeCertificateAuthority`
+- `DescribeClusterVersions`
 - `DescribeEksAnywhereSubscription`
 - `DescribeFargateProfile`
 - `DescribeInsight`
+- `DescribeInsightsRefresh`
 - `DescribePodIdentityAssociation`
+- `ListCapabilities`
+- `ListCertificateAuthorities`
 - `ListEksAnywhereSubscriptions`
 - `ListFargateProfiles`
 - `ListInsights`
 - `ListPodIdentityAssociations`
 - `RegisterCluster`
+- `StartInsightsRefresh`
+- `UpdateCapability`
 - `UpdateEksAnywhereSubscription`
 - `UpdatePodIdentityAssociation`

@@ -680,7 +930,7 @@ spot-price: On owned hardware there is no spot-to-on-demand price differential,

 ## elasticloadbalancingv2

-`2015-12-01` — 34 of 46 modelled operations implemented (73.9%), 0 stubbed, 0 not applicable, 4 registered outside the pinned model.
+`2015-12-01` — 36 of 51 modelled operations implemented (70.6%), 0 stubbed, 0 not applicable, 2 registered outside the pinned model.

 ### Not implemented

@@ -688,31 +938,36 @@ spot-price: On owned hardware there is no spot-to-on-demand price differential,
 - `CreateTrustStore`
 - `DeleteSharedTrustStoreAssociation`
 - `DeleteTrustStore`
+- `DescribeCapacityReservation`
 - `DescribeTrustStoreAssociations`
 - `DescribeTrustStoreRevocations`
 - `DescribeTrustStores`
 - `GetResourcePolicy`
 - `GetTrustStoreCaCertificatesBundle`
 - `GetTrustStoreRevocationContent`
+- `ModifyCapacityReservation`
+- `ModifyIpPools`
 - `ModifyTrustStore`
 - `RemoveTrustStoreRevocations`

 ### Registered outside the pinned model

- `DescribeListenerAttributes`
 - `GetLBConfig`
 - `LBAgentHeartbeat`
- `ModifyListenerAttributes`

 ## iam

-`2010-05-08` — 76 of 159 modelled operations implemented (47.8%), 0 stubbed, 19 not applicable, 0 registered outside the pinned model.
+`2010-05-08` — 76 of 180 modelled operations implemented (42.2%), 0 stubbed, 19 not applicable, 0 registered outside the pinned model.

 ### Not implemented

+- `AcceptDelegationRequest`
+- `AcquireRole`
 - `AddClientIDToOpenIDConnectProvider`
+- `AssociateDelegationRequest`
 - `ChangePassword`
 - `CreateAccountAlias`
+- `CreateDelegationRequest`
 - `CreateLoginProfile`
 - `CreatePolicyVersion`
 - `CreateSAMLProvider`
@@ -727,34 +982,50 @@ spot-price: On owned hardware there is no spot-to-on-demand price differential,
 - `DeleteServerCertificate`
 - `DeleteUserPermissionsBoundary`
 - `DeleteVirtualMFADevice`
+- `DisableOrganizationsRootCredentialsManagement`
+- `DisableOrganizationsRootSessions`
+- `DisableOutboundWebIdentityFederation`
 - `EnableMFADevice`
+- `EnableOrganizationsRootCredentialsManagement`
+- `EnableOrganizationsRootSessions`
+- `EnableOutboundWebIdentityFederation`
 - `GenerateCredentialReport`
 - `GenerateServiceLastAccessedDetails`
 - `GetAccessKeyLastUsed`
 - `GetAccountAuthorizationDetails`
 - `GetAccountPasswordPolicy`
+- `GetAccountProperties`
 - `GetContextKeysForCustomPolicy`
 - `GetContextKeysForPrincipalPolicy`
 - `GetCredentialReport`
+- `GetDelegationRequest`
+- `GetHumanReadableSummary`
 - `GetLoginProfile`
 - `GetMFADevice`
+- `GetOutboundWebIdentityFederationInfo`
+- `GetRoleTemplateVersion`
 - `GetSAMLProvider`
 - `GetServerCertificate`
 - `GetServiceLastAccessedDetails`
 - `GetServiceLastAccessedDetailsWithEntities`
 - `ListAccountAliases`
+- `ListDelegationRequests`
 - `ListMFADeviceTags`
 - `ListMFADevices`
+- `ListOrganizationsFeatures`
 - `ListPoliciesGrantingServiceAccess`
 - `ListSAMLProviderTags`
 - `ListSAMLProviders`
 - `ListServerCertificateTags`
 - `ListServerCertificates`
 - `ListVirtualMFADevices`
+- `PutAccountProperties`
 - `PutRolePermissionsBoundary`
 - `PutUserPermissionsBoundary`
+- `RejectDelegationRequest`
 - `RemoveClientIDFromOpenIDConnectProvider`
 - `ResyncMFADevice`
+- `SendDelegationToken`
 - `SetDefaultPolicyVersion`
 - `SetSecurityTokenServicePreferences`
 - `SimulateCustomPolicy`
@@ -766,6 +1037,7 @@ spot-price: On owned hardware there is no spot-to-on-demand price differential,
 - `UntagSAMLProvider`
 - `UntagServerCertificate`
 - `UpdateAccountPasswordPolicy`
+- `UpdateDelegationRequest`
 - `UpdateGroup`
 - `UpdateLoginProfile`
 - `UpdateOpenIDConnectProviderThumbprint`
@@ -810,7 +1082,7 @@ signing-certificates: X.509 signing certificates are an EC2-Classic SOAP credent

 ## rds

-`2014-10-31` — 26 of 162 modelled operations implemented (16.0%), 0 stubbed, 4 not applicable, 5 registered outside the pinned model.
+`2014-10-31` — 26 of 164 modelled operations implemented (15.9%), 0 stubbed, 4 not applicable, 5 registered outside the pinned model.

 ### Not implemented

@@ -866,6 +1138,7 @@ signing-certificates: X.509 signing certificates are an EC2-Classic SOAP credent
 - `DescribeDBClusterSnapshotAttributes`
 - `DescribeDBClusterSnapshots`
 - `DescribeDBLogFiles`
+- `DescribeDBMajorEngineVersions`
 - `DescribeDBProxies`
 - `DescribeDBProxyEndpoints`
 - `DescribeDBProxyTargetGroups`
@@ -886,6 +1159,7 @@ signing-certificates: X.509 signing certificates are an EC2-Classic SOAP credent
 - `DescribePendingMaintenanceActions`
 - `DescribeReservedDBInstances`
 - `DescribeReservedDBInstancesOfferings`
+- `DescribeServerlessV2PlatformVersions`
 - `DescribeSourceRegions`
 - `DescribeTenantDatabases`
 - `DescribeValidDBInstanceModifications`
@@ -969,34 +1243,40 @@ option-groups: Option groups configure engine add-ons for engines this platform

 ## s3

-`2006-03-01` — 26 of 99 modelled operations implemented (26.3%), 0 stubbed, 6 not applicable, 0 registered outside the pinned model.
+`2006-03-01` — 26 of 112 modelled operations implemented (23.2%), 0 stubbed, 6 not applicable, 0 registered outside the pinned model.

 ### Not implemented

+- `CreateBucketMetadataConfiguration`
+- `CreateBucketMetadataTableConfiguration`
 - `DeleteBucketAnalyticsConfiguration`
 - `DeleteBucketCors`
 - `DeleteBucketEncryption`
 - `DeleteBucketIntelligentTieringConfiguration`
 - `DeleteBucketInventoryConfiguration`
 - `DeleteBucketLifecycle`
+- `DeleteBucketMetadataConfiguration`
+- `DeleteBucketMetadataTableConfiguration`
 - `DeleteBucketMetricsConfiguration`
 - `DeleteBucketOwnershipControls`
 - `DeleteBucketPolicy`
 - `DeleteBucketReplication`
 - `DeleteBucketWebsite`
+- `DeleteObjectAnnotation`
 - `DeleteObjectTagging`
 - `DeletePublicAccessBlock`
+- `GetBucketAbac`
 - `GetBucketAcl`
 - `GetBucketAnalyticsConfiguration`
 - `GetBucketCors`
 - `GetBucketEncryption`
 - `GetBucketIntelligentTieringConfiguration`
 - `GetBucketInventoryConfiguration`
- `GetBucketLifecycle`
 - `GetBucketLifecycleConfiguration`
 - `GetBucketLogging`
+- `GetBucketMetadataConfiguration`
+- `GetBucketMetadataTableConfiguration`
 - `GetBucketMetricsConfiguration`
- `GetBucketNotification`
 - `GetBucketNotificationConfiguration`
 - `GetBucketOwnershipControls`
 - `GetBucketPolicy`
@@ -1004,6 +1284,7 @@ option-groups: Option groups configure engine add-ons for engines this platform
 - `GetBucketReplication`
 - `GetBucketWebsite`
 - `GetObjectAcl`
+- `GetObjectAnnotation`
 - `GetObjectAttributes`
 - `GetObjectLegalHold`
 - `GetObjectLockConfiguration`
@@ -1016,30 +1297,36 @@ option-groups: Option groups configure engine add-ons for engines this platform
 - `ListBucketInventoryConfigurations`
 - `ListBucketMetricsConfigurations`
 - `ListDirectoryBuckets`
+- `ListObjectAnnotations`
+- `PutBucketAbac`
 - `PutBucketAcl`
 - `PutBucketAnalyticsConfiguration`
 - `PutBucketCors`
 - `PutBucketEncryption`
 - `PutBucketIntelligentTieringConfiguration`
 - `PutBucketInventoryConfiguration`
- `PutBucketLifecycle`
 - `PutBucketLifecycleConfiguration`
 - `PutBucketLogging`
 - `PutBucketMetricsConfiguration`
- `PutBucketNotification`
 - `PutBucketNotificationConfiguration`
 - `PutBucketOwnershipControls`
 - `PutBucketPolicy`
 - `PutBucketReplication`
 - `PutBucketWebsite`
 - `PutObjectAcl`
+- `PutObjectAnnotation`
 - `PutObjectLegalHold`
 - `PutObjectLockConfiguration`
 - `PutObjectRetention`
 - `PutObjectTagging`
 - `PutPublicAccessBlock`
+- `RenameObject`
 - `RestoreObject`
 - `SelectObjectContent`
+- `UpdateBucketMetadataAnnotationTableConfiguration`
+- `UpdateBucketMetadataInventoryTableConfiguration`
+- `UpdateBucketMetadataJournalTableConfiguration`
+- `UpdateObjectEncryption`

 ### Not applicable — do not build

@@ -1063,11 +1350,14 @@ request-payment: Requester Pays shifts transfer charges to the caller, which nee

 ## sts

-`2011-06-15` — 5 of 8 modelled operations implemented (62.5%), 0 stubbed, 0 not applicable, 0 registered outside the pinned model.
+`2011-06-15` — 5 of 11 modelled operations implemented (45.5%), 0 stubbed, 0 not applicable, 0 registered outside the pinned model.

 ### Not implemented

 - `AssumeRoleWithSAML`
+- `AssumeRoot`
 - `DecodeAuthorizationMessage`
+- `GetDelegatedAccessToken`
 - `GetFederationToken`
+- `GetWebIdentityToken`

@@ -50,7 +50,9 @@ type coverageJSON struct {
 }

 type coverageJSONModelSource struct {
-	AWSSDKGoVersion string `json:"aws_sdk_go_version"`
+	Repository string `json:"repository"`
+	Commit     string `json:"commit"`
+	CommitDate string `json:"commit_date"`
 }

 type coverageJSONService struct {
@@ -165,7 +167,7 @@ func toSet(values []string) map[string]bool {
 // terminal. The published pages carry the per-operation detail.
 func RenderCoverageSummary(coverages []OperationCoverage) string {
 	var report strings.Builder
-	fmt.Fprintf(&report, "AWS model operation coverage (aws-sdk-go %s)\n\n", SourceSDKVersion)
+	fmt.Fprintf(&report, "AWS model operation coverage (%s)\n\n", ModelSourceDescription())
 	for _, coverage := range sortedCoverages(coverages) {
 		if coverage.Opaque {
 			fmt.Fprintf(&report, "%-24s %-12s not enumerable\n", coverage.Service, coverage.APIVersion)
@@ -186,7 +188,9 @@ func RenderCoverageJSON(coverages []OperationCoverage) (string, error) {
 	document := coverageJSON{
 		SchemaVersion: CoverageJSONSchemaVersion,
 		ModelSource: coverageJSONModelSource{
-			AWSSDKGoVersion: SourceSDKVersion,
+			Repository: ModelRepository,
+			Commit:     ModelCommit,
+			CommitDate: ModelCommitDate,
 		},
 		Services: make([]coverageJSONService, 0, len(coverages)),
 	}
@@ -244,7 +248,7 @@ func RenderInternalReport(coverages []OperationCoverage, pages PageSet) string {
 	report.WriteString("# AWS Model Operation Coverage (internal)\n\n")
 	report.WriteString("Generated by `make aws-model-coverage`. This file is not published: it carries the counts and the unimplemented operations that the pages under this directory deliberately leave out.\n\n")
 	report.WriteString("**Not implemented** is the candidate work. **Not applicable** is declared in `pages.json` and is not work: those operations describe something this platform will not have.\n\n")
-	fmt.Fprintf(&report, "Pinned model source: `aws-sdk-go %s`.\n\n", SourceSDKVersion)
+	fmt.Fprintf(&report, "Pinned model source: `%s`.\n\n", ModelSourceDescription())

 	for _, coverage := range sortedCoverages(coverages) {
 		page := pages.Services[coverage.Service]
@@ -31,7 +31,9 @@ func TestRenderCoverageJSONIsDeterministicAndPreservesDispatchStates(t *testing.
 	var document struct {
 		SchemaVersion int `json:"schema_version"`
 		ModelSource   struct {
-			AWSSDKGoVersion string `json:"aws_sdk_go_version"`
+			Repository string `json:"repository"`
+			Commit     string `json:"commit"`
+			CommitDate string `json:"commit_date"`
 		} `json:"model_source"`
 		Services []struct {
 			Service    string `json:"service"`
@@ -49,8 +51,8 @@ func TestRenderCoverageJSONIsDeterministicAndPreservesDispatchStates(t *testing.
 	if document.SchemaVersion != awsmodel.CoverageJSONSchemaVersion {
 		t.Errorf("schema version = %d, want %d", document.SchemaVersion, awsmodel.CoverageJSONSchemaVersion)
 	}
-	if document.ModelSource.AWSSDKGoVersion != awsmodel.SourceSDKVersion {
-		t.Errorf("source version = %q, want %q", document.ModelSource.AWSSDKGoVersion, awsmodel.SourceSDKVersion)
+	if source := document.ModelSource; source.Repository != awsmodel.ModelRepository || source.Commit != awsmodel.ModelCommit || source.CommitDate != awsmodel.ModelCommitDate {
+		t.Errorf("model source = %+v, want %s at %s (%s)", source, awsmodel.ModelRepository, awsmodel.ModelCommit, awsmodel.ModelCommitDate)
 	}
 	if !strings.Contains(contents, `"registered": []`) {
 		t.Errorf("an empty operation set must be an array, not null:\n%s", contents)
@@ -17,8 +17,8 @@ func TestCompareOperations(t *testing.T) {
 	if len(coverage.Implemented) != 1 || coverage.Implemented[0] != "AssumeRole" {
 		t.Fatalf("implemented = %v, want [AssumeRole]", coverage.Implemented)
 	}
-	if len(coverage.Missing) != 5 {
-		t.Fatalf("missing count = %d, want 5: %v", len(coverage.Missing), coverage.Missing)
+	if len(coverage.Missing) != 8 {
+		t.Fatalf("missing count = %d, want 8: %v", len(coverage.Missing), coverage.Missing)
 	}
 	if len(coverage.Extra) != 1 || coverage.Extra[0] != "ExtraOperation" {
 		t.Fatalf("extra = %v, want [ExtraOperation]", coverage.Extra)
@@ -39,8 +39,8 @@ func TestRenderCoverageSummary(t *testing.T) {
 	}
 	report := RenderCoverageSummary([]OperationCoverage{coverage})
 	for _, want := range []string{
-		"aws-sdk-go " + SourceSDKVersion,
-		"1 of   8 implemented ( 12.5%)",
+		ModelSourceDescription(),
+		"1 of  11 implemented (  9.1%)",
 	} {
 		if !strings.Contains(report, want) {
 			t.Errorf("summary does not contain %q:\n%s", want, report)
@@ -85,8 +85,8 @@ var loadEC2ErrorCatalog = sync.OnceValues(func() (*ec2ErrorCatalog, error) {

 // ValidateEC2ErrorResponse validates an EC2 Query API error envelope against
 // the checked-in catalog curated from AWS's EC2 error-code reference. The AWS
-// api-2.json model declares no operation errors, so this is intentionally a
-// separate oracle.
+// EC2 model declares no operation errors, so this is intentionally a separate
+// oracle.
 func ValidateEC2ErrorResponse(status int, body []byte) ([]Violation, error) {
 	root, err := parseXML(body)
 	if err != nil {
@@ -2,22 +2,21 @@ package awsmodel

 import "embed"

-// modelFS contains only the curated EC2 error catalog. The large upstream
-// api-2.json files are resolved from the pinned aws-sdk-go module cache at
-// runtime; they are intentionally not source-controlled here.
+// modelFS holds the Smithy service models, gzipped, from the api-models-aws
+// commit named by ModelCommit, and the curated EC2 error catalog.
 //
-//go:embed models/ec2/error-codes.json
+//go:embed models/*.json.gz models/ec2/error-codes.json
 var modelFS embed.FS

 var modelFiles = map[Service]string{
-	ACM:                    "models/apis/acm/2015-12-08/api-2.json",
-	EC2:                    "models/apis/ec2/2016-11-15/api-2.json",
-	ECR:                    "models/apis/ecr/2015-09-21/api-2.json",
-	ECS:                    "models/apis/ecs/2014-11-13/api-2.json",
-	EKS:                    "models/apis/eks/2017-11-01/api-2.json",
-	ElasticLoadBalancingV2: "models/apis/elasticloadbalancingv2/2015-12-01/api-2.json",
-	IAM:                    "models/apis/iam/2010-05-08/api-2.json",
-	RDS:                    "models/apis/rds/2014-10-31/api-2.json",
-	S3:                     "models/apis/s3/2006-03-01/api-2.json",
-	STS:                    "models/apis/sts/2011-06-15/api-2.json",
+	ACM:                    "models/acm-2015-12-08.json.gz",
+	EC2:                    "models/ec2-2016-11-15.json.gz",
+	ECR:                    "models/ecr-2015-09-21.json.gz",
+	ECS:                    "models/ecs-2014-11-13.json.gz",
+	EKS:                    "models/eks-2017-11-01.json.gz",
+	ElasticLoadBalancingV2: "models/elastic-load-balancing-v2-2015-12-01.json.gz",
+	IAM:                    "models/iam-2010-05-08.json.gz",
+	RDS:                    "models/rds-2014-10-31.json.gz",
+	S3:                     "models/s3-2006-03-01.json.gz",
+	STS:                    "models/sts-2011-06-15.json.gz",
 }
@@ -51,7 +51,7 @@ func isUnmodelledCommonError(service Service, code string) bool {
 	case IAM, ElasticLoadBalancingV2:
 		return isUnmodelledQueryError(code)
 	case STS:
-		// STS also uses these two runtime input errors even though api-2.json
+		// STS also uses these two runtime input errors even though the model
 		// does not declare them on AssumeRole/GetSessionToken.
 		return isUnmodelledQueryError(code) || code == "ValidationError" || code == "InvalidParameterValue"
 	case ECS:
@@ -1,26 +1,28 @@
-// Package awsmodel loads the AWS api-2.json service definitions used by the
-// conformance suite.
+// Package awsmodel loads the AWS Smithy service models used by the
+// conformance suite and translates them into the api-2.json shaped structs
+// its validators read.
 package awsmodel

 import (
-	"encoding/json"
+	"bytes"
+	"compress/gzip"
 	"fmt"
+	"io"
 	"maps"
-	"os"
-	"os/exec"
-	"os/user"
-	"path/filepath"
 	"slices"
 	"sync"
 )

-// SourceSDKVersion is the aws-sdk-go release whose module-cache models are
-// used by the conformance suite.
-const SourceSDKVersion = "v1.55.8"
+// ModelRepository is where the embedded models come from. The commit is
+// recorded in model_source.go by scripts/sync-aws-models.sh.
+const ModelRepository = "github.com/aws/api-models-aws"

-const sourceSDKModule = "github.com/aws/aws-sdk-go"
+// ModelSourceDescription names the pinned model source for reports.
+func ModelSourceDescription() string {
+	return fmt.Sprintf("%s@%.12s, %s", ModelRepository, ModelCommit, ModelCommitDate)
+}

-// Service identifies an AWS service model loaded from the SDK module cache.
+// Service identifies an AWS service model embedded in this package.
 type Service string

 const (
@@ -37,77 +39,74 @@ const (
 )

 // Metadata describes the service and wire protocol represented by a model.
+// Protocol uses the api-2.json names: json, rest-json, rest-xml, query, ec2.
 type Metadata struct {
-	APIVersion          string   `json:"apiVersion"`
-	EndpointPrefix      string   `json:"endpointPrefix"`
-	Protocol            string   `json:"protocol"`
-	Protocols           []string `json:"protocols"`
-	ServiceAbbreviation string   `json:"serviceAbbreviation"`
-	ServiceFullName     string   `json:"serviceFullName"`
-	ServiceID           string   `json:"serviceId"`
-	SignatureVersion    string   `json:"signatureVersion"`
-	UID                 string   `json:"uid"`
+	APIVersion      string
+	EndpointPrefix  string
+	Protocol        string
+	ServiceFullName string
+	ServiceID       string
 }

 // Operation describes an AWS API operation and the shapes used by its input,
 // output and declared errors.
 type Operation struct {
-	Name   string     `json:"name"`
-	HTTP   HTTP       `json:"http"`
-	Input  *ShapeRef  `json:"input"`
-	Output *ShapeRef  `json:"output"`
-	Errors []ShapeRef `json:"errors"`
+	Name   string
+	HTTP   HTTP
+	Input  *ShapeRef
+	Output *ShapeRef
+	Errors []ShapeRef
 }

 // HTTP describes an operation's HTTP binding.
 type HTTP struct {
-	Method       string `json:"method"`
-	RequestURI   string `json:"requestUri"`
-	ResponseCode int    `json:"responseCode"`
+	Method       string
+	RequestURI   string
+	ResponseCode int
 }

 // Shape describes a value in an AWS service model. Depending on Type, it can
 // refer to structure members, a list member, or map keys and values.
 type Shape struct {
-	Type            string              `json:"type"`
-	Required        []string            `json:"required"`
-	Members         map[string]ShapeRef `json:"members"`
-	Member          *ShapeRef           `json:"member"`
-	Key             *ShapeRef           `json:"key"`
-	Value           *ShapeRef           `json:"value"`
-	Enum            []string            `json:"enum"`
-	Min             *float64            `json:"min"`
-	Max             *float64            `json:"max"`
-	Pattern         string              `json:"pattern"`
-	LocationName    string              `json:"locationName"`
-	TimestampFormat string              `json:"timestampFormat"`
-	Payload         string              `json:"payload"`
-	Flattened       bool                `json:"flattened"`
-	Sensitive       bool                `json:"sensitive"`
-	Exception       bool                `json:"exception"`
-	Fault           bool                `json:"fault"`
-	Error           *ErrorInfo          `json:"error"`
+	Type            string
+	Required        []string
+	Members         map[string]ShapeRef
+	Member          *ShapeRef
+	Key             *ShapeRef
+	Value           *ShapeRef
+	Enum            []string
+	Min             *float64
+	Max             *float64
+	Pattern         string
+	LocationName    string
+	TimestampFormat string
+	Payload         string
+	Flattened       bool
+	Sensitive       bool
+	Exception       bool
+	Fault           bool
+	Error           *ErrorInfo
 }

 // ErrorInfo describes an error shape's code and HTTP classification.
 type ErrorInfo struct {
-	Code           string `json:"code"`
-	HTTPStatusCode int    `json:"httpStatusCode"`
-	SenderFault    bool   `json:"senderFault"`
+	Code           string
+	HTTPStatusCode int
+	SenderFault    bool
 }

 // ShapeRef names another shape and carries any wire binding specific to the
 // place where it is referenced.
 type ShapeRef struct {
-	Shape           string `json:"shape"`
-	ResultWrapper   string `json:"resultWrapper"`
-	Location        string `json:"location"`
-	LocationName    string `json:"locationName"`
-	QueryName       string `json:"queryName"`
-	TimestampFormat string `json:"timestampFormat"`
-	Flattened       bool   `json:"flattened"`
-	Streaming       bool   `json:"streaming"`
-	XMLAttribute    bool   `json:"xmlAttribute"`
+	Shape           string
+	ResultWrapper   string
+	Location        string
+	LocationName    string
+	QueryName       string
+	TimestampFormat string
+	Flattened       bool
+	Streaming       bool
+	XMLAttribute    bool
 }

 // Model is an indexed AWS service definition.
@@ -118,13 +117,6 @@ type Model struct {
 	shapes     map[string]*Shape
 }

-type modelDocument struct {
-	Version    string                `json:"version"`
-	Metadata   Metadata              `json:"metadata"`
-	Operations map[string]*Operation `json:"operations"`
-	Shapes     map[string]*Shape     `json:"shapes"`
-}
-
 type loadResult struct {
 	model *Model
 	err   error
@@ -132,31 +124,6 @@ type loadResult struct {

 var modelCache sync.Map

-var modelRoot = sync.OnceValues(resolveModelRoot)
-
-func resolveModelRoot() (string, error) {
-	if root := os.Getenv("GOMODCACHE"); root != "" {
-		return filepath.Join(root, sourceSDKModule+"@"+SourceSDKVersion), nil
-	}
-	if output, err := exec.Command("go", "env", "GOMODCACHE").Output(); err == nil {
-		if root := string(output); root != "" {
-			return filepath.Join(stringTrimSpace(root), sourceSDKModule+"@"+SourceSDKVersion), nil
-		}
-	}
-	currentUser, err := user.Current()
-	if err != nil {
-		return "", fmt.Errorf("awsmodel: resolve Go module cache: %w", err)
-	}
-	return filepath.Join(currentUser.HomeDir, "go", "pkg", "mod", sourceSDKModule+"@"+SourceSDKVersion), nil
-}
-
-func stringTrimSpace(value string) string {
-	for len(value) > 0 && (value[len(value)-1] == '\n' || value[len(value)-1] == '\r' || value[len(value)-1] == ' ' || value[len(value)-1] == '\t') {
-		value = value[:len(value)-1]
-	}
-	return value
-}
-
 // Services returns the supported service identifiers in stable order.
 func Services() []Service {
 	services := make([]Service, 0, len(modelFiles))
@@ -167,45 +134,21 @@ func Services() []Service {
 	return services
 }

-// Load parses and indexes the cached SDK model for service. Each service is
+// Load parses and indexes the embedded model for service. Each service is
 // parsed at most once and the resulting Model is safe for concurrent reads.
 func Load(service Service) (*Model, error) {
-	path, ok := modelFiles[service]
+	file, ok := modelFiles[service]
 	if !ok {
 		return nil, fmt.Errorf("awsmodel: unsupported service %q", service)
 	}

 	loader, _ := modelCache.LoadOrStore(service, sync.OnceValue(func() loadResult {
-		root, err := modelRoot()
+		contents, err := readModel(file)
 		if err != nil {
-			return loadResult{err: err}
+			return loadResult{err: fmt.Errorf("awsmodel: read %s model: %w", service, err)}
 		}
-		contents, err := os.ReadFile(filepath.Join(root, path))
-		if err != nil {
-			return loadResult{err: fmt.Errorf("awsmodel: read cached %s model at %s: %w", service, filepath.Join(root, path), err)}
-		}
-
-		var document modelDocument
-		if err := json.Unmarshal(contents, &document); err != nil {
-			return loadResult{err: fmt.Errorf("awsmodel: parse %s model: %w", service, err)}
-		}
-		if document.Version != "2.0" {
-			return loadResult{err: fmt.Errorf("awsmodel: %s model version is %q, want %q", service, document.Version, "2.0")}
-		}
-		if len(document.Operations) == 0 || len(document.Shapes) == 0 {
-			return loadResult{err: fmt.Errorf("awsmodel: %s model has no operations or shapes", service)}
-		}
-
-		model := &Model{
-			service:    service,
-			metadata:   document.Metadata,
-			operations: document.Operations,
-			shapes:     document.Shapes,
-		}
-		if err := model.validateReferences(); err != nil {
-			return loadResult{err: err}
-		}
-		return loadResult{model: model}
+		model, err := parseSmithyModel(service, contents)
+		return loadResult{model: model, err: err}
 	}))
 	load, ok := loader.(func() loadResult)
 	if !ok {
@@ -215,10 +158,23 @@ func Load(service Service) (*Model, error) {
 	return result.model, result.err
 }

+func readModel(file string) ([]byte, error) {
+	compressed, err := modelFS.ReadFile(file)
+	if err != nil {
+		return nil, err
+	}
+	reader, err := gzip.NewReader(bytes.NewReader(compressed))
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = reader.Close() }()
+	return io.ReadAll(reader)
+}
+
 // Service returns the identifier used to load the model.
 func (m *Model) Service() Service { return m.service }

-// Metadata returns the service metadata from api-2.json.
+// Metadata returns the service metadata.
 func (m *Model) Metadata() Metadata { return m.metadata }

 // Operation resolves an operation by its model key, such as DescribeInstances.
@@ -0,0 +1,10 @@
+// Code generated by scripts/sync-aws-models.sh. DO NOT EDIT.
+
+package awsmodel
+
+// ModelCommit is the github.com/aws/api-models-aws commit the embedded
+// models were taken from, and ModelCommitDate the day it was committed.
+const (
+	ModelCommit     = "9b1a4929274443d8671ea8acfda7afbe856e29e9"
+	ModelCommitDate = "2026-09-25"
+)
@@ -20,16 +20,16 @@ func TestLoadAllModels(t *testing.T) {
 		operations int
 		shapes     int
 	}{
-		ACM:                    {"2015-12-08", 15, 102},
-		EC2:                    {"2016-11-15", 625, 3198},
-		ECR:                    {"2015-09-21", 47, 330},
-		ECS:                    {"2014-11-13", 56, 400},
-		EKS:                    {"2017-11-01", 56, 298},
-		ElasticLoadBalancingV2: {"2015-12-01", 46, 357},
-		IAM:                    {"2010-05-08", 159, 497},
-		RDS:                    {"2014-10-31", 162, 745},
-		S3:                     {"2006-03-01", 99, 604},
-		STS:                    {"2011-06-15", 8, 76},
+		ACM:                    {"2015-12-08", 40, 239},
+		EC2:                    {"2016-11-15", 804, 4245},
+		ECR:                    {"2015-09-21", 58, 404},
+		ECS:                    {"2014-11-13", 77, 643},
+		EKS:                    {"2017-11-01", 70, 450},
+		ElasticLoadBalancingV2: {"2015-12-01", 51, 418},
+		IAM:                    {"2010-05-08", 180, 624},
+		RDS:                    {"2014-10-31", 164, 791},
+		S3:                     {"2006-03-01", 112, 710},
+		STS:                    {"2011-06-15", 11, 101},
 	}

 	for service, want := range wantSizes {
@@ -1,5 +1,7 @@
-# AWS model cache
+# AWS models

-The conformance suite reads `api-2.json` from the Go module cache for the pinned `github.com/aws/aws-sdk-go` version `v1.55.8`. Running Go tests or `go mod download` populates that cache; the large upstream model files are intentionally not tracked in this repository.
+The `*.json.gz` files are the Smithy JSON AST service models from [`aws/api-models-aws`](https://github.com/aws/api-models-aws), gzipped and embedded into the binary, so loading them needs no network or Go module cache. All ten come from the one commit recorded in `../model_source.go`.

-`ec2/error-codes.json` is separate from the SDK models because EC2's `api-2.json` declares no operation errors. It is a curated subset of the official [EC2 error-code reference](https://docs.aws.amazon.com/ec2/latest/devguide/errors-overview.html): all documented common and server codes, plus the action-specific codes that Spinifex currently emits. The catalog records its verification date and must be reviewed against that source when it changes.
+Do not edit them by hand. To move to a newer commit, run `scripts/sync-aws-models.sh <commit-sha>`, then `make generate-aws-model-coverage` and review the regenerated `docs/coverage` and the `awsmodel` test expectations: a newer model can add operations, required members and enum values, and each resulting finding is a real gap to triage rather than a reason to stay on an older commit.
+
+`ec2/error-codes.json` is separate from the service models because the EC2 model declares no operation errors. It is a curated subset of the official [EC2 error-code reference](https://docs.aws.amazon.com/ec2/latest/devguide/errors-overview.html): all documented common and server codes, plus the action-specific codes that Spinifex currently emits. The catalog records its verification date and must be reviewed against that source when it changes.
@@ -13,7 +13,7 @@ import (
 // ValidateResponse decodes an AWS wire response and validates it against the
 // operation's output shape. JSON services are decoded directly; EC2 and Query
 // XML responses are normalized from their wire names and result wrappers to
-// api-2.json member names first.
+// model member names first.
 func ValidateResponse(service Service, operationName string, body []byte) ([]Violation, error) {
 	model, err := Load(service)
 	if err != nil {
@@ -0,0 +1,570 @@
+package awsmodel
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+)
+
+// Smithy JSON AST documents, as published by github.com/aws/api-models-aws.
+// Only the parts the loader translates are decoded.
+type smithyDocument struct {
+	Smithy string                 `json:"smithy"`
+	Shapes map[string]smithyShape `json:"shapes"`
+}
+
+type smithyShape struct {
+	Type    string         `json:"type"`
+	Version string         `json:"version"`
+	Input   *smithyMember  `json:"input"`
+	Output  *smithyMember  `json:"output"`
+	Errors  []smithyMember `json:"errors"`
+	Members smithyMembers  `json:"members"`
+	Member  *smithyMember  `json:"member"`
+	Key     *smithyMember  `json:"key"`
+	Value   *smithyMember  `json:"value"`
+	Traits  smithyTraits   `json:"traits"`
+}
+
+type smithyMember struct {
+	Target string       `json:"target"`
+	Traits smithyTraits `json:"traits"`
+}
+
+type namedSmithyMember struct {
+	smithyMember
+
+	name string
+}
+
+// smithyMembers keeps members in document order, which is the order AWS
+// declares enum values and structure members in.
+type smithyMembers []namedSmithyMember
+
+func (m *smithyMembers) UnmarshalJSON(data []byte) error {
+	decoder := json.NewDecoder(bytes.NewReader(data))
+	if token, err := decoder.Token(); err != nil || token != json.Delim('{') {
+		return fmt.Errorf("members is not an object")
+	}
+	for decoder.More() {
+		token, err := decoder.Token()
+		if err != nil {
+			return err
+		}
+		name, ok := token.(string)
+		if !ok {
+			return fmt.Errorf("member name is not a string")
+		}
+		var member smithyMember
+		if err := decoder.Decode(&member); err != nil {
+			return fmt.Errorf("member %q: %w", name, err)
+		}
+		*m = append(*m, namedSmithyMember{smithyMember: member, name: name})
+	}
+	_, err := decoder.Token()
+	return err
+}
+
+type smithyTraits map[string]json.RawMessage
+
+func (t smithyTraits) has(name string) bool {
+	_, ok := t[name]
+	return ok
+}
+
+// decode reports whether the trait is present, and fails if it is present
+// but does not decode into value.
+func (t smithyTraits) decode(name string, value any) (bool, error) {
+	raw, ok := t[name]
+	if !ok {
+		return false, nil
+	}
+	if err := json.Unmarshal(raw, value); err != nil {
+		return true, fmt.Errorf("trait %s: %w", name, err)
+	}
+	return true, nil
+}
+
+func (t smithyTraits) string(name string) (string, error) {
+	var value string
+	_, err := t.decode(name, &value)
+	return value, err
+}
+
+const (
+	smithyPrelude = "smithy.api#"
+	smithyUnit    = smithyPrelude + "Unit"
+)
+
+// smithyProtocols maps a service's protocol trait to the api-2.json protocol
+// name the decoders switch on.
+var smithyProtocols = map[string]string{
+	"aws.protocols#awsJson1_0": "json",
+	"aws.protocols#awsJson1_1": "json",
+	"aws.protocols#restJson1":  "rest-json",
+	"aws.protocols#restXml":    "rest-xml",
+	"aws.protocols#awsQuery":   "query",
+	"aws.protocols#ec2Query":   "ec2",
+}
+
+// smithyTypes maps Smithy shape types onto the api-2.json type vocabulary.
+// Enums become constrained strings and unions structures, as they were there.
+var smithyTypes = map[string]string{
+	"blob":       "blob",
+	"boolean":    "boolean",
+	"string":     "string",
+	"enum":       "string",
+	"byte":       "integer",
+	"short":      "integer",
+	"integer":    "integer",
+	"intEnum":    "integer",
+	"long":       "long",
+	"float":      "float",
+	"double":     "double",
+	"bigInteger": "long",
+	"bigDecimal": "double",
+	"timestamp":  "timestamp",
+	"document":   "document",
+	"list":       "list",
+	"map":        "map",
+	"structure":  "structure",
+	"union":      "structure",
+}
+
+// preludeTypes are the Smithy prelude shapes a model may target without
+// defining them.
+var preludeTypes = map[string]string{
+	"Blob":             "blob",
+	"Boolean":          "boolean",
+	"PrimitiveBoolean": "boolean",
+	"String":           "string",
+	"Byte":             "integer",
+	"PrimitiveByte":    "integer",
+	"Short":            "integer",
+	"PrimitiveShort":   "integer",
+	"Integer":          "integer",
+	"PrimitiveInteger": "integer",
+	"Long":             "long",
+	"PrimitiveLong":    "long",
+	"Float":            "float",
+	"PrimitiveFloat":   "float",
+	"Double":           "double",
+	"PrimitiveDouble":  "double",
+	"BigInteger":       "long",
+	"BigDecimal":       "double",
+	"Timestamp":        "timestamp",
+	"Document":         "document",
+}
+
+// smithyTranslator converts one Smithy service model into the api-2.json
+// shaped Model the validators read.
+type smithyTranslator struct {
+	service  Service
+	document smithyDocument
+	protocol string
+	shapes   map[string]*Shape
+}
+
+func parseSmithyModel(service Service, contents []byte) (*Model, error) {
+	translator := smithyTranslator{service: service, shapes: map[string]*Shape{}}
+	if err := json.Unmarshal(contents, &translator.document); err != nil {
+		return nil, fmt.Errorf("awsmodel: parse %s model: %w", service, err)
+	}
+	if !strings.HasPrefix(translator.document.Smithy, "2.") {
+		return nil, fmt.Errorf("awsmodel: %s model is Smithy %q, want 2.x", service, translator.document.Smithy)
+	}
+	model, err := translator.translate()
+	if err != nil {
+		return nil, fmt.Errorf("awsmodel: translate %s model: %w", service, err)
+	}
+	return model, nil
+}
+
+func (t *smithyTranslator) translate() (*Model, error) {
+	metadata, err := t.metadata()
+	if err != nil {
+		return nil, err
+	}
+	t.protocol = metadata.Protocol
+
+	if err := t.checkLocalNames(); err != nil {
+		return nil, err
+	}
+
+	operations := map[string]*Operation{}
+	for id, shape := range t.document.Shapes {
+		switch shape.Type {
+		case "service", "resource":
+			continue
+		case "operation":
+			operation, err := t.operation(id, shape)
+			if err != nil {
+				return nil, fmt.Errorf("operation %s: %w", id, err)
+			}
+			operations[operation.Name] = operation
+		default:
+			translated, err := t.shape(shape)
+			if err != nil {
+				return nil, fmt.Errorf("shape %s: %w", id, err)
+			}
+			t.shapes[localName(id)] = translated
+		}
+	}
+	if len(operations) == 0 || len(t.shapes) == 0 {
+		return nil, errors.New("model has no operations or shapes")
+	}
+
+	model := &Model{
+		service:    t.service,
+		metadata:   metadata,
+		operations: operations,
+		shapes:     t.shapes,
+	}
+	if err := model.validateReferences(); err != nil {
+		return nil, err
+	}
+	return model, nil
+}
+
+func (t *smithyTranslator) metadata() (Metadata, error) {
+	var service *smithyShape
+	for id, shape := range t.document.Shapes {
+		if shape.Type != "service" {
+			continue
+		}
+		if service != nil {
+			return Metadata{}, fmt.Errorf("model defines more than one service, including %s", id)
+		}
+		service = &shape
+	}
+	if service == nil {
+		return Metadata{}, errors.New("model defines no service")
+	}
+
+	metadata := Metadata{APIVersion: service.Version}
+	for trait, protocol := range smithyProtocols {
+		if !service.Traits.has(trait) {
+			continue
+		}
+		if metadata.Protocol != "" {
+			return Metadata{}, fmt.Errorf("service declares more than one protocol")
+		}
+		metadata.Protocol = protocol
+	}
+	if metadata.Protocol == "" {
+		return Metadata{}, errors.New("service declares no supported protocol")
+	}
+
+	var awsService struct {
+		SDKID          string `json:"sdkId"`
+		EndpointPrefix string `json:"endpointPrefix"`
+	}
+	if _, err := service.Traits.decode("aws.api#service", &awsService); err != nil {
+		return Metadata{}, err
+	}
+	title, err := service.Traits.string("smithy.api#title")
+	if err != nil {
+		return Metadata{}, err
+	}
+	metadata.EndpointPrefix = awsService.EndpointPrefix
+	metadata.ServiceID = awsService.SDKID
+	metadata.ServiceFullName = title
+	return metadata, nil
+}
+
+// checkLocalNames rejects a model whose shapes would collide once their
+// namespaces are dropped, which would silently merge two shapes into one.
+func (t *smithyTranslator) checkLocalNames() error {
+	seen := make(map[string]string, len(t.document.Shapes))
+	for id := range t.document.Shapes {
+		name := localName(id)
+		if other, ok := seen[name]; ok {
+			return fmt.Errorf("shapes %s and %s share the local name %q", id, other, name)
+		}
+		seen[name] = id
+	}
+	return nil
+}
+
+// localName drops the namespace from a model's own shape IDs. Prelude shapes
+// keep their absolute ID: a model may define a same-named shape of its own.
+func localName(id string) string {
+	if strings.HasPrefix(id, smithyPrelude) {
+		return id
+	}
+	if separator := strings.LastIndex(id, "#"); separator >= 0 {
+		return id[separator+1:]
+	}
+	return id
+}
+
+func (t *smithyTranslator) operation(id string, shape smithyShape) (*Operation, error) {
+	operation := &Operation{Name: localName(id)}
+
+	var httpTrait struct {
+		Method string `json:"method"`
+		URI    string `json:"uri"`
+		Code   int    `json:"code"`
+	}
+	found, err := shape.Traits.decode("smithy.api#http", &httpTrait)
+	if err != nil {
+		return nil, err
+	}
+	if found {
+		operation.HTTP = HTTP{Method: httpTrait.Method, RequestURI: httpTrait.URI, ResponseCode: httpTrait.Code}
+	} else {
+		// The RPC protocols bind every operation to a POST of /.
+		operation.HTTP = HTTP{Method: "POST", RequestURI: "/"}
+	}
+
+	if operation.Input, err = t.operationRef(shape.Input); err != nil {
+		return nil, fmt.Errorf("input: %w", err)
+	}
+	if operation.Output, err = t.operationRef(shape.Output); err != nil {
+		return nil, fmt.Errorf("output: %w", err)
+	}
+	// awsQuery wraps every modelled output in <OperationResult>, which Smithy
+	// leaves to the protocol rather than recording on the operation.
+	if operation.Output != nil && t.protocol == "query" {
+		operation.Output.ResultWrapper = operation.Name + "Result"
+	}
+	for _, errorRef := range shape.Errors {
+		ref, err := t.ref(errorRef)
+		if err != nil {
+			return nil, fmt.Errorf("error %s: %w", errorRef.Target, err)
+		}
+		operation.Errors = append(operation.Errors, ref)
+	}
+	return operation, nil
+}
+
+func (t *smithyTranslator) operationRef(member *smithyMember) (*ShapeRef, error) {
+	if member == nil || member.Target == smithyUnit {
+		return nil, nil
+	}
+	ref, err := t.ref(*member)
+	if err != nil {
+		return nil, err
+	}
+	return &ref, nil
+}
+
+func (t *smithyTranslator) shape(source smithyShape) (*Shape, error) {
+	shapeType, ok := smithyTypes[source.Type]
+	if !ok {
+		return nil, fmt.Errorf("unsupported shape type %q", source.Type)
+	}
+	shape := &Shape{Type: shapeType}
+
+	switch source.Type {
+	case "enum":
+		for _, member := range source.Members {
+			value, err := member.Traits.string("smithy.api#enumValue")
+			if err != nil {
+				return nil, fmt.Errorf("enum member %s: %w", member.name, err)
+			}
+			if value == "" {
+				value = member.name
+			}
+			shape.Enum = append(shape.Enum, value)
+		}
+	case "structure", "union":
+		shape.Members = make(map[string]ShapeRef, len(source.Members))
+		for _, member := range source.Members {
+			ref, err := t.memberRef(member)
+			if err != nil {
+				return nil, fmt.Errorf("member %s: %w", member.name, err)
+			}
+			shape.Members[member.name] = ref
+			if member.Traits.has("smithy.api#required") {
+				shape.Required = append(shape.Required, member.name)
+			}
+			if member.Traits.has("smithy.api#httpPayload") {
+				shape.Payload = member.name
+			}
+		}
+	case "list":
+		ref, err := t.containerRef("member", source.Member)
+		if err != nil {
+			return nil, err
+		}
+		shape.Member = ref
+	case "map":
+		key, err := t.containerRef("key", source.Key)
+		if err != nil {
+			return nil, err
+		}
+		value, err := t.containerRef("value", source.Value)
+		if err != nil {
+			return nil, err
+		}
+		shape.Key, shape.Value = key, value
+	}
+
+	if err := t.applyShapeTraits(shape, source.Traits); err != nil {
+		return nil, err
+	}
+	return shape, nil
+}
+
+func (t *smithyTranslator) applyShapeTraits(shape *Shape, traits smithyTraits) error {
+	var bounds struct {
+		Min *float64 `json:"min"`
+		Max *float64 `json:"max"`
+	}
+	for _, trait := range []string{"smithy.api#length", "smithy.api#range"} {
+		if _, err := traits.decode(trait, &bounds); err != nil {
+			return err
+		}
+	}
+	shape.Min, shape.Max = bounds.Min, bounds.Max
+
+	var err error
+	if shape.Pattern, err = traits.string("smithy.api#pattern"); err != nil {
+		return err
+	}
+	if shape.LocationName, err = traits.string("smithy.api#xmlName"); err != nil {
+		return err
+	}
+	if shape.TimestampFormat, err = timestampFormat(traits); err != nil {
+		return err
+	}
+	shape.Sensitive = traits.has("smithy.api#sensitive")
+
+	kind, err := traits.string("smithy.api#error")
+	if err != nil || kind == "" {
+		return err
+	}
+	shape.Exception = true
+	shape.Fault = kind == "server"
+	shape.Error = &ErrorInfo{SenderFault: kind == "client"}
+	if _, err := traits.decode("smithy.api#httpError", &shape.Error.HTTPStatusCode); err != nil {
+		return err
+	}
+	// A JSON service's awsQueryError is only for awsQueryCompatible clients;
+	// its wire code is still the shape name.
+	if t.protocol != "query" {
+		return nil
+	}
+	var queryError struct {
+		Code             string `json:"code"`
+		HTTPResponseCode int    `json:"httpResponseCode"`
+	}
+	if _, err := traits.decode("aws.protocols#awsQueryError", &queryError); err != nil {
+		return err
+	}
+	shape.Error.Code = queryError.Code
+	if queryError.HTTPResponseCode != 0 {
+		shape.Error.HTTPStatusCode = queryError.HTTPResponseCode
+	}
+	return nil
+}
+
+// timestampFormats maps Smithy's timestamp formats to the api-2.json names.
+var timestampFormats = map[string]string{
+	"date-time":     "iso8601",
+	"http-date":     "rfc822",
+	"epoch-seconds": "unixTimestamp",
+}
+
+func timestampFormat(traits smithyTraits) (string, error) {
+	format, err := traits.string("smithy.api#timestampFormat")
+	if err != nil || format == "" {
+		return "", err
+	}
+	name, ok := timestampFormats[format]
+	if !ok {
+		return "", fmt.Errorf("unsupported timestamp format %q", format)
+	}
+	return name, nil
+}
+
+func (t *smithyTranslator) containerRef(label string, member *smithyMember) (*ShapeRef, error) {
+	if member == nil {
+		return nil, fmt.Errorf("%s is missing", label)
+	}
+	ref, err := t.memberRef(namedSmithyMember{smithyMember: *member, name: label})
+	if err != nil {
+		return nil, fmt.Errorf("%s: %w", label, err)
+	}
+	return &ref, nil
+}
+
+// memberRef translates a member's wire-binding traits onto the reference.
+func (t *smithyTranslator) memberRef(member namedSmithyMember) (ShapeRef, error) {
+	ref, err := t.ref(member.smithyMember)
+	if err != nil {
+		return ShapeRef{}, err
+	}
+	traits := member.Traits
+
+	names := []struct {
+		trait string
+		value *string
+	}{
+		{"smithy.api#xmlName", &ref.LocationName},
+		{"smithy.api#jsonName", &ref.LocationName},
+		{"aws.protocols#ec2QueryName", &ref.QueryName},
+	}
+	for _, binding := range names {
+		if value, err := traits.string(binding.trait); err != nil {
+			return ShapeRef{}, err
+		} else if value != "" {
+			*binding.value = value
+		}
+	}
+	if ref.TimestampFormat, err = timestampFormat(traits); err != nil {
+		return ShapeRef{}, err
+	}
+	ref.Flattened = traits.has("smithy.api#xmlFlattened")
+	ref.XMLAttribute = traits.has("smithy.api#xmlAttribute")
+
+	httpBindings := []struct {
+		trait    string
+		location string
+	}{
+		{"smithy.api#httpHeader", "header"},
+		{"smithy.api#httpPrefixHeaders", "headers"},
+		{"smithy.api#httpQuery", "querystring"},
+	}
+	for _, binding := range httpBindings {
+		if !traits.has(binding.trait) {
+			continue
+		}
+		name, err := traits.string(binding.trait)
+		if err != nil {
+			return ShapeRef{}, err
+		}
+		ref.Location, ref.LocationName = binding.location, name
+	}
+	switch {
+	case traits.has("smithy.api#httpLabel"):
+		ref.Location, ref.LocationName = "uri", member.name
+	case traits.has("smithy.api#httpQueryParams"):
+		ref.Location = "querystring"
+	case traits.has("smithy.api#httpResponseCode"):
+		ref.Location = "statusCode"
+	}
+	return ref, nil
+}
+
+// ref resolves a target to its local name, registering any prelude shape it
+// names so reference validation can find it.
+func (t *smithyTranslator) ref(member smithyMember) (ShapeRef, error) {
+	target := member.Target
+	if name, isPrelude := strings.CutPrefix(target, smithyPrelude); isPrelude {
+		preludeType, ok := preludeTypes[name]
+		if !ok {
+			return ShapeRef{}, fmt.Errorf("unsupported prelude target %s", target)
+		}
+		t.shapes[target] = &Shape{Type: preludeType}
+		return ShapeRef{Shape: target}, nil
+	}
+	shape, ok := t.document.Shapes[target]
+	if !ok {
+		return ShapeRef{}, fmt.Errorf("unknown target %s", target)
+	}
+	return ShapeRef{Shape: localName(target), Streaming: shape.Traits.has("smithy.api#streaming")}, nil
+}
@@ -0,0 +1,193 @@
+package awsmodel
+
+import (
+	"net/http"
+	"reflect"
+	"strings"
+	"testing"
+)
+
+func mustLoad(t *testing.T, service Service) *Model {
+	t.Helper()
+	model, err := Load(service)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return model
+}
+
+func mustShape(t *testing.T, model *Model, name string) *Shape {
+	t.Helper()
+	shape, ok := model.Shape(name)
+	if !ok {
+		t.Fatalf("%s shape %q is not indexed", model.Service(), name)
+	}
+	return shape
+}
+
+func TestSmithyProtocols(t *testing.T) {
+	want := map[Service]string{
+		ACM: "json", EC2: "ec2", ECR: "json", ECS: "json", EKS: "rest-json",
+		ElasticLoadBalancingV2: "query", IAM: "query", RDS: "query", S3: "rest-xml", STS: "query",
+	}
+	for service, protocol := range want {
+		if got := mustLoad(t, service).Metadata().Protocol; got != protocol {
+			t.Errorf("%s protocol = %q, want %q", service, got, protocol)
+		}
+	}
+}
+
+func TestSmithyEnumKeepsDeclaredOrder(t *testing.T) {
+	shape := mustShape(t, mustLoad(t, IAM), "statusType")
+	if shape.Type != "string" {
+		t.Errorf("enum type = %q, want string", shape.Type)
+	}
+	if want := []string{"Active", "Inactive", "Expired"}; !reflect.DeepEqual(shape.Enum, want) {
+		t.Errorf("statusType enum = %v, want %v", shape.Enum, want)
+	}
+}
+
+func TestSmithyConstraints(t *testing.T) {
+	model := mustLoad(t, IAM)
+	request := mustShape(t, model, "CreateUserRequest")
+	if want := []string{"UserName"}; !reflect.DeepEqual(request.Required, want) {
+		t.Errorf("CreateUserRequest required = %v, want %v", request.Required, want)
+	}
+	userName := mustShape(t, model, request.Members["UserName"].Shape)
+	if userName.Min == nil || *userName.Min != 1 || userName.Max == nil || *userName.Max != 64 {
+		t.Errorf("user name length = %v..%v, want 1..64", userName.Min, userName.Max)
+	}
+	if userName.Pattern == "" {
+		t.Error("user name pattern was not loaded")
+	}
+	maxItems := mustShape(t, model, "maxItemsType")
+	if maxItems.Min == nil || *maxItems.Min != 1 || maxItems.Max == nil || *maxItems.Max != 1000 {
+		t.Errorf("maxItemsType range = %v..%v, want 1..1000", maxItems.Min, maxItems.Max)
+	}
+}
+
+func TestSmithyQueryResultWrapper(t *testing.T) {
+	iam := mustLoad(t, IAM)
+	deleteUser, _ := iam.Operation("DeleteUser")
+	if deleteUser == nil || deleteUser.Output != nil {
+		t.Errorf("DeleteUser output = %+v, want none for a Unit output", deleteUser)
+	}
+	if deleteUser.HTTP.Method != http.MethodPost || deleteUser.HTTP.RequestURI != "/" {
+		t.Errorf("DeleteUser HTTP = %+v, want POST /", deleteUser.HTTP)
+	}
+
+	describe, _ := mustLoad(t, EC2).Operation("DescribeInstances")
+	if describe == nil || describe.Output == nil || describe.Output.ResultWrapper != "" {
+		t.Errorf("DescribeInstances output = %+v, want no wrapper for ec2", describe)
+	}
+}
+
+func TestSmithyXMLNames(t *testing.T) {
+	model := mustLoad(t, EC2)
+	result := mustShape(t, model, "DescribeInstancesResult")
+	reservations := result.Members["Reservations"]
+	if reservations.LocationName != "reservationSet" || reservations.QueryName != "ReservationSet" {
+		t.Errorf("Reservations ref = %+v, want reservationSet / ReservationSet", reservations)
+	}
+	if item := mustShape(t, model, reservations.Shape).Member; item == nil || item.LocationName != "item" {
+		t.Errorf("ReservationList member = %+v, want item", item)
+	}
+}
+
+func TestSmithyErrors(t *testing.T) {
+	iamError := mustShape(t, mustLoad(t, IAM), "EntityAlreadyExistsException")
+	if !iamError.Exception || iamError.Fault {
+		t.Errorf("exception/fault = %v/%v, want true/false", iamError.Exception, iamError.Fault)
+	}
+	if want := (ErrorInfo{Code: "EntityAlreadyExists", HTTPStatusCode: 409, SenderFault: true}); iamError.Error == nil || *iamError.Error != want {
+		t.Errorf("error = %+v, want %+v", iamError.Error, want)
+	}
+
+	// ACM declares awsQueryError codes for compatibility clients, but its
+	// JSON wire code stays the shape name.
+	acm := mustLoad(t, ACM)
+	deleteCertificate, _ := acm.Operation("DeleteCertificate")
+	codes := acm.operationErrorCodes(deleteCertificate)
+	if !strings.Contains(strings.Join(codes, ","), "AccessDeniedException") {
+		t.Errorf("DeleteCertificate codes = %v, want AccessDeniedException", codes)
+	}
+}
+
+func TestSmithyHTTPBindings(t *testing.T) {
+	model := mustLoad(t, S3)
+	getObject, _ := model.Operation("GetObject")
+	if getObject.HTTP.Method != http.MethodGet || !strings.HasPrefix(getObject.HTTP.RequestURI, "/{Bucket}/{Key+}") || getObject.HTTP.ResponseCode != 200 {
+		t.Errorf("GetObject HTTP = %+v", getObject.HTTP)
+	}
+
+	request := mustShape(t, model, getObject.Input.Shape)
+	for member, want := range map[string][2]string{
+		"Bucket":     {"uri", "Bucket"},
+		"Range":      {"header", "Range"},
+		"VersionId":  {"querystring", "versionId"},
+		"PartNumber": {"querystring", "partNumber"},
+	} {
+		ref := request.Members[member]
+		if ref.Location != want[0] || ref.LocationName != want[1] {
+			t.Errorf("GetObjectRequest.%s binding = %s %s, want %s %s", member, ref.Location, ref.LocationName, want[0], want[1])
+		}
+	}
+
+	output := mustShape(t, model, getObject.Output.Shape)
+	if output.Payload != "Body" || !output.Members["Body"].Streaming {
+		t.Errorf("GetObjectOutput payload = %q, Body = %+v", output.Payload, output.Members["Body"])
+	}
+	if metadata := output.Members["Metadata"]; metadata.Location != "headers" || metadata.LocationName != "x-amz-meta-" {
+		t.Errorf("Metadata binding = %+v", metadata)
+	}
+	if expires := output.Members["LastModified"]; expires.LocationName != "Last-Modified" {
+		t.Errorf("LastModified binding = %+v", expires)
+	}
+}
+
+func TestSmithyPreludeTargets(t *testing.T) {
+	model := mustLoad(t, ACM)
+	account := mustShape(t, model, "AcmeAccount")
+	ref := account.Members["AccountUrl"]
+	if ref.Shape != "smithy.api#String" {
+		t.Fatalf("AccountUrl target = %q, want the prelude String", ref.Shape)
+	}
+	if shape := mustShape(t, model, ref.Shape); shape.Type != "string" {
+		t.Errorf("prelude String type = %q", shape.Type)
+	}
+}
+
+func TestParseSmithyModelRejectsMalformedModels(t *testing.T) {
+	const service = `"a.b#Svc": {"type": "service", "version": "1", "traits": {"aws.protocols#awsJson1_1": {}}}`
+	const operation = `"a.b#Op": {"type": "operation", "input": {"target": "a.b#In"}}`
+	const input = `"a.b#In": {"type": "structure", "members": {"X": {"target": "a.b#Missing"}}}`
+	tests := map[string]struct {
+		document string
+		want     string
+	}{
+		"old smithy": {`{"smithy": "1.0", "shapes": {}}`, `want 2.x`},
+		"no service": {`{"smithy": "2.0", "shapes": {` + operation + `}}`, "defines no service"},
+		"two services": {
+			`{"smithy": "2.0", "shapes": {` + service + `, "a.b#Other": {"type": "service"}}}`,
+			"more than one service",
+		},
+		"no protocol":    {`{"smithy": "2.0", "shapes": {"a.b#Svc": {"type": "service"}}}`, "no supported protocol"},
+		"unknown target": {`{"smithy": "2.0", "shapes": {` + service + `, ` + operation + `, ` + input + `}}`, "unknown target a.b#Missing"},
+		"name collision": {
+			`{"smithy": "2.0", "shapes": {` + service + `, "a.b#X": {"type": "string"}, "c.d#X": {"type": "string"}}}`,
+			`share the local name "X"`,
+		},
+		"unsupported type": {
+			`{"smithy": "2.0", "shapes": {` + service + `, ` + operation + `, "a.b#In": {"type": "mystery"}}}`,
+			`unsupported shape type "mystery"`,
+		},
+	}
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			_, err := parseSmithyModel("test", []byte(test.document))
+			if err == nil || !strings.Contains(err.Error(), test.want) {
+				t.Fatalf("error = %v, want it to contain %q", err, test.want)
+			}
+		})
+	}
+}
@@ -32,7 +32,7 @@ func (v Violation) String() string {
 }

 // Validate checks a normalized response document against an operation's
-// output shape. Structure keys must use the member names from api-2.json;
+// output shape. Structure keys must use the model's member names;
 // protocol-specific response middleware is responsible for translating wire
 // names and wrappers to that representation.
 func Validate(service Service, operationName string, document any) ([]Violation, error) {
@@ -56,7 +56,7 @@ func TestValidateEnum(t *testing.T) {
 	want := []Violation{{
 		Rule:    RuleEnum,
 		Path:    "$.tasks[0].launchType",
-		Message: "value \"ON_PREMISES\" is not one of [EC2, FARGATE, EXTERNAL]",
+		Message: "value \"ON_PREMISES\" is not one of [EC2, FARGATE, EXTERNAL, MANAGED_INSTANCES]",
 	}}
 	if !reflect.DeepEqual(violations, want) {
 		t.Fatalf("violations = %#v, want %#v", violations, want)
@@ -41,6 +41,7 @@ Both ship to `/usr/local/share/spinifex/` on every node, so they are available o
 | `test-ddil-phase1.sh` | systemd-level smoke test for daemon-local-autonomy tier 1. Destructive on the local node: stops and starts `spinifex-nats` and restarts `spinifex-daemon`, restoring both via a cleanup trap. |
 | `check-coverage.sh` | Fails the build if total Go coverage falls below the minimum threshold, excluding packages exempt from the requirement. |
 | `diff-coverage.sh` | Coverage check scoped to changed lines only, against an auto-detected base ref (`HEAD~1` on main, `origin/main` on dev, otherwise `origin/dev`). |
+| `sync-aws-models.sh` | Replaces the embedded AWS Smithy models under `internal/awsmodel/models/` with the ten service files from `aws/api-models-aws` at the given commit, and records that commit in `internal/awsmodel/model_source.go`. Takes a full 40-character SHA. |
 | `run-bench.sh` | Launches a benchmark against running Ubuntu instances, auto-detecting the AMI for the host architecture. Tracks nbdkit and perf alongside the run. |
 | `disk-performance.sh` | Runs a `fio` random 70/30 read-write benchmark swept across 4k/16k/128k/1M. Writes JSON results to `/tmp/spinifex-disk-bench`; override with `BENCH_DIR`, `OUT_DIR`, `SIZE`, `JOBS`, `BLOCK_SIZES`. |
 | `network-performance.sh` | iperf throughput from several clients to one server, driven over SSH, writing a `summary.txt` of Gbit/s per client. `--server-ip` sets the address clients dial, so pointing it at instance private addresses measures the VPC overlay rather than the external pool. |
@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Download the AWS Smithy service models used by internal/awsmodel from
+# github.com/aws/api-models-aws at one pinned commit, gzip them into
+# internal/awsmodel/models/ and record the commit in model_source.go.
+# Usage: scripts/sync-aws-models.sh <commit-sha>
+
+COMMIT="${1:?Usage: sync-aws-models.sh <commit-sha>}"
+if [[ ! "$COMMIT" =~ ^[0-9a-f]{40}$ ]]; then
+    echo "ERROR: commit must be a full 40-character SHA, got '$COMMIT'" >&2
+    exit 1
+fi
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+PKG="$ROOT/internal/awsmodel"
+OUT="$PKG/models"
+REPO="https://github.com/aws/api-models-aws.git"
+
+# <api-models-aws sdk-id>/<api version>
+MODELS=(
+    acm/2015-12-08
+    ec2/2016-11-15
+    ecr/2015-09-21
+    ecs/2014-11-13
+    eks/2017-11-01
+    elastic-load-balancing-v2/2015-12-01
+    iam/2010-05-08
+    rds/2014-10-31
+    s3/2006-03-01
+    sts/2011-06-15
+)
+
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+
+# A blobless shallow fetch pulls only the ten files read below.
+git -C "$TMP" init --quiet repo
+git -C "$TMP/repo" fetch --quiet --depth=1 --filter=blob:none "$REPO" "$COMMIT"
+COMMITTED="$(git -C "$TMP/repo" log -1 --format=%cs "$COMMIT")"
+
+for entry in "${MODELS[@]}"; do
+    sdk_id="${entry%%/*}"
+    version="${entry##*/}"
+    file="$sdk_id-$version.json"
+    echo "fetching $sdk_id $version"
+    git -C "$TMP/repo" show "$COMMIT:models/$sdk_id/service/$version/$file" > "$TMP/$file"
+    # -n omits the name and timestamp so re-running at one commit is a no-op.
+    gzip -n -9 --stdout "$TMP/$file" > "$TMP/$file.gz"
+done
+
+mkdir -p "$OUT"
+rm -f "$OUT"/*.json.gz
+mv "$TMP"/*.json.gz "$OUT"/
+
+cat > "$PKG/model_source.go" <<EOF
+// Code generated by scripts/sync-aws-models.sh. DO NOT EDIT.
+
+package awsmodel
+
+// ModelCommit is the github.com/aws/api-models-aws commit the embedded
+// models were taken from, and ModelCommitDate the day it was committed.
+const (
+	ModelCommit     = "$COMMIT"
+	ModelCommitDate = "$COMMITTED"
+)
+EOF
+
+echo "wrote ${#MODELS[@]} models at $COMMIT ($COMMITTED) to $OUT"